Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 21:46
Behavioral task
behavioral1
Sample
656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe
- Size 93KB
- Sample240407-1mlf7afd2v
- SHA256 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814
- MD5 670b9efbce32f96937ef964e8788d16e
- SHA1 bf0b6e9bcdc86cbd5703cbce08f248c120dc872d
- SHA512 5dd416962f9ef7a46d9cbc9d7648ea9468bfb373024b3fa0b39852742bf53045c7b1c8353be647201d94efd12b71709e79912dc54b9f7dcb02c1956ff3650007
- SSDEEP 1536:aWAL/OkxsTnljt6GjbF7BV9sa7V1Ayj4m/QWR/Rlq88vlnRqPR/1aViDRknJM2St:aDOkexJLFdrPZ1Tj4mYWR/R4nkPR/1aG
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral2/memory/1748-48-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-186-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3288-189-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-190-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-194-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-196-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-205-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-208-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-212-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-215-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-218-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-221-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-224-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-227-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-230-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-233-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4236-236-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 19 IoCs
resource yara_rule behavioral2/memory/4236-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/files/0x0006000000023209-5.dat UPX behavioral2/memory/1748-48-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-186-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3288-189-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-190-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-194-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-196-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-205-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-208-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-212-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-215-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-218-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-221-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-224-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-227-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-230-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-233-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/4236-236-0x0000000000400000-0x000000000041B000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4236-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/files/0x0006000000023209-5.dat upx behavioral2/memory/1748-48-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-186-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3288-189-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-190-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-194-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-196-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-205-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-208-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-212-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-215-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-218-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-221-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-224-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-227-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-230-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-233-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/4236-236-0x0000000000400000-0x000000000041B000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\U: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\W: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\E: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\H: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\O: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\Z: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\B: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\K: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\N: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\S: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\T: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\V: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\Y: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\A: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\G: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\I: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\J: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\M: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\P: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\Q: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\R: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File opened (read-only) \??\X: 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian handjob lingerie big pregnant .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese animal hardcore catfight .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\FxsTmp\spanish blowjob girls titts bondage .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\fucking [free] glans boots .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\japanese cum lingerie hidden stockings .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\config\systemprofile\danish gang bang horse hot (!) black hairunshaved .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\IME\SHARED\lingerie several models traffic .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\System32\DriverStore\Temp\russian cum horse public cock girly .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\IME\SHARED\italian kicking trambling catfight .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\blowjob girls .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\FxsTmp\american fetish bukkake girls hairy .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish action beast lesbian feet .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian nude lingerie lesbian .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Common Files\microsoft shared\bukkake several models .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Microsoft Office\root\Templates\japanese kicking xxx masturbation .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\indian fetish sperm voyeur (Sylvia).mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\horse licking .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files (x86)\Google\Update\Download\fucking masturbation (Jade).zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\dotnet\shared\bukkake several models bondage .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\russian action blowjob hidden beautyfull .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\xxx uncut femdom .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish gang bang bukkake masturbation hole shoes .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\swedish nude bukkake several models (Samantha).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\italian animal sperm [free] balls .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\xxx masturbation glans (Gina,Samantha).zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files (x86)\Google\Temp\fucking [bangbus] cock .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files\Microsoft Office\Updates\Download\swedish cum bukkake licking cock .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\italian gang bang lesbian several models .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\gay [bangbus] (Curtney).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Program Files (x86)\Microsoft\Temp\horse [free] glans (Kathrin,Melissa).mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\norwegian hardcore lesbian redhair .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\norwegian fucking public (Sylvia).mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\bukkake voyeur (Samantha).zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\german fucking sleeping cock wifey (Karin).mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\bukkake [bangbus] beautyfull .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\spanish sperm lesbian glans 50+ (Curtney).zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\spanish lesbian full movie .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\animal hardcore [free] feet .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\canadian xxx lesbian (Liz).rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\american animal horse full movie feet (Christine,Curtney).rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\tyrkish beastiality lingerie [milf] titts .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\PLA\Templates\bukkake licking .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\lingerie masturbation hole stockings (Samantha).rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\italian porn beast licking glans .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\fucking big bedroom .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\fucking girls .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\spanish lesbian hot (!) sweet .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\chinese xxx girls feet 50+ (Sylvia).mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\tyrkish horse blowjob girls girly (Sandy,Janette).mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\action gay several models glans (Britney,Samantha).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\spanish sperm lesbian titts leather .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\swedish porn bukkake hidden .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\danish handjob hardcore [free] (Tatjana).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\african lesbian [milf] (Tatjana).mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\british lingerie hidden hole 40+ .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish cumshot blowjob licking cock latex .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian porn beast catfight .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\tyrkish gang bang horse girls titts hairy .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\norwegian trambling hot (!) titts pregnant .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\malaysia bukkake sleeping (Melissa).mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\canadian horse full movie black hairunshaved .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\cum hardcore [milf] cock sweet .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\gang bang trambling hot (!) femdom .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\black kicking lesbian girls (Sarah).rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\blowjob sleeping glans leather .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\cum fucking hidden (Karin).zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\norwegian gay public wifey .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\fetish bukkake hot (!) femdom .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\american beastiality gay hidden circumcision .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\gang bang lingerie licking feet 40+ .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\xxx [free] titts ejaculation (Melissa).zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore girls hole (Britney,Janette).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\french trambling voyeur .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\indian cum xxx uncut feet .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\nude gay big hole .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\malaysia sperm voyeur cock mistress (Curtney).rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\danish handjob gay lesbian (Sarah).mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\black action beast uncut 40+ .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\black cumshot gay masturbation hole (Jenna,Liz).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\black porn fucking catfight feet balls .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\fetish gay uncut feet YEâPSè& (Jade).mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\german fucking [bangbus] sm .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\russian animal xxx [free] (Janette).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\french bukkake big feet hairy (Samantha).rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\trambling masturbation hairy (Sonja,Curtney).avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\asian lesbian lesbian .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\french lingerie big girly .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\brasilian cum blowjob several models upskirt .rar.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\horse blowjob masturbation YEâPSè& .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\brasilian cumshot bukkake uncut (Sylvia).zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\black cum gay voyeur titts .mpg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\spanish gay lesbian .avi.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\norwegian xxx hot (!) hairy .zip.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\german beast lesbian hole fishy .mpeg.exe 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 3288 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4236 wrote to memory of 1748 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 85 PID 4236 wrote to memory of 1748 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 85 PID 4236 wrote to memory of 1748 4236 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 85 PID 1748 wrote to memory of 3288 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 86 PID 1748 wrote to memory of 3288 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 86 PID 1748 wrote to memory of 3288 1748 656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe"C:\Users\Admin\AppData\Local\Temp\656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe"C:\Users\Admin\AppData\Local\Temp\656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe"C:\Users\Admin\AppData\Local\Temp\656c9e62ad74c930c0581ec72f40e76ff937f3c99cca63d02e845a65ec3ed814.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish gang bang bukkake masturbation hole shoes .avi.exe
- Size 146KB
- SHA256 282ada12b6bb9fa07d823189d0c8c0a86c3538dc64b17bf5eddf3ddd6552c34a
- MD5 71fd4357aaf6a4544f18d5b8c4314ce2
- SHA1 9cf8a6fc1a2af6618b43d6511ae6745a35002557
- SHA512 1af7c744bc0130d05be7fba3645adf3d42bfda9f4a90abbcb4ac12be7002608798da1a3c3c9d6eb7c05fcd76b3f4a05e67384b700227313b3c4b99ea00cd2417
- SSDEEP 3072:aDOkexJLFdrPZ1Tj4mYWR/R4nkPR/1aVuyJomm2g6PrLCjfD3fgK7AyW:aDOxZXPIo5R4nM/40yJDmv6PwDvBAyW
- MD5 SHA1 SHA512 SSDEEP