Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 23:17
Behavioral task
behavioral1
Sample
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe
Resource
win10v2004-20240319-en
General
-
Target
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe
-
Size
361KB
-
MD5
a6d0264c7ea6056dec2f24e714189567
-
SHA1
e76d1ba7b3fc43594bc4173c0c3f1b8e2158d997
-
SHA256
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8
-
SHA512
fb58384f0d06b63ed93526e39f47b0e7435b771bd0af3c788ba8f61b6616ade67ae151913dd9b6092634af8a3f91e8268a51701d1432510c3ca45a00c352a482
-
SSDEEP
6144:VjluQoSv4DSIo5R4nM/40yw5MCDsdycfd5pMZj8070WQ95Zml5Ahq/JN6/m6Sutk:VEQoSfqHCDyyWDQf70il5OAT6/5Se+ka
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2404-11-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2832-53-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2572-54-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-84-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2572-94-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-95-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-96-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-101-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-105-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-119-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-123-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-127-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-131-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-137-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-141-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-145-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-149-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-153-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2512-157-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\porn animal sleeping beautyfull (Karin,Sarah).avi.exe UPX behavioral1/memory/2404-11-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2832-53-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2572-54-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-84-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2572-94-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-95-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-96-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-101-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-105-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-119-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-123-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-127-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-131-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-137-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-141-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-145-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-149-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-153-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2512-157-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\porn animal sleeping beautyfull (Karin,Sarah).avi.exe upx behavioral1/memory/2404-11-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2832-53-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2572-54-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-84-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2572-94-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-95-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-96-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-101-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-105-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-119-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-123-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-127-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-131-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-137-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-141-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-145-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-149-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-153-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2512-157-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exedescription ioc process File opened (read-only) \??\L: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\T: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\Y: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\G: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\K: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\I: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\N: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\O: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\Q: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\R: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\V: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\E: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\H: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\W: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\B: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\U: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\M: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\P: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\S: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\X: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\Z: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\A: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File opened (read-only) \??\J: 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe -
Drops file in System32 directory 10 IoCs
Processes:
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exedescription ioc process File created C:\Windows\System32\LogFiles\Fax\Incoming\chinese xxx hardcore masturbation (Kathrin,Karin).mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\FxsTmp\russian kicking [free] mature .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\IME\shared\american cumshot public Ôë .rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\FxsTmp\gang bang [bangbus] .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\IME\shared\asian porn sleeping nipples lady .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\config\systemprofile\bukkake horse sleeping .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\animal girls legs stockings (Ashley).mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\config\systemprofile\indian cum catfight gorgeoushorny (Sonja).rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\british fucking [free] glans wifey .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\System32\DriverStore\Temp\swedish fucking horse voyeur boobs .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe -
Drops file in Program Files directory 15 IoCs
Processes:
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exedescription ioc process File created C:\Program Files\Windows Journal\Templates\russian animal public .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\porn animal sleeping beautyfull (Karin,Sarah).avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Common Files\microsoft shared\chinese cumshot cumshot hot (!) legs latex (Jenna,Christine).mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\sperm licking girly .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\beastiality gay several models glans mature .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files\Common Files\Microsoft Shared\japanese gang bang big .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Google\Update\Download\asian horse animal several models .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\handjob xxx several models black hairunshaved .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\brasilian beastiality action [free] vagina .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\gang bang gay voyeur legs gorgeoushorny .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\norwegian sperm bukkake lesbian .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Microsoft Office\Templates\indian nude full movie boobs .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files\DVD Maker\Shared\japanese cum beast lesbian .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\chinese cum nude full movie hole upskirt .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Program Files (x86)\Google\Temp\cumshot [milf] balls .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe -
Drops file in Windows directory 64 IoCs
Processes:
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exedescription ioc process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\german fetish lingerie hot (!) glans penetration (Jade).zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\asian cumshot licking (Sandy).mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\african cum hot (!) ash .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\japanese lingerie fucking masturbation .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\bukkake voyeur balls (Sandy,Sonja).mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\french blowjob kicking voyeur castration .rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\american animal several models .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\action several models .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\beastiality voyeur .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\gang bang lesbian .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\french porn [milf] girly .rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\norwegian bukkake big circumcision .rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\fucking [bangbus] hairy .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\norwegian blowjob fetish uncut redhair (Christine,Christine).avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\italian lesbian sperm public (Sylvia,Anniston).zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\canadian beastiality xxx masturbation pregnant .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\trambling hidden swallow (Sarah).mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\InstallTemp\indian hardcore bukkake lesbian vagina bedroom .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\action public boobs latex .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\cum catfight (Sarah).zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\action hot (!) wifey .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\kicking horse hidden boobs mistress (Janette).rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\beastiality action public boobs ìï (Ashley).rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\brasilian lesbian masturbation cock hairy .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\danish lesbian xxx [milf] shower .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\tyrkish sperm voyeur shower .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\blowjob horse hot (!) cock high heels .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\beastiality [bangbus] .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\canadian cumshot nude [free] legs .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\black action masturbation penetration (Curtney,Curtney).mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\Downloaded Program Files\black bukkake kicking sleeping cock bondage (Tatjana).mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\malaysia xxx [free] balls .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\assembly\temp\handjob catfight balls (Jade).mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\american horse horse masturbation .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\handjob public ejaculation .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\handjob lingerie several models .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\PLA\Templates\bukkake uncut ejaculation .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\brasilian fetish sperm full movie .rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\chinese lesbian hardcore hot (!) .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\lingerie action [milf] fishy (Sylvia).mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\animal licking .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\chinese horse cumshot voyeur bondage (Karin).rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\chinese bukkake gang bang public .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\malaysia trambling [free] castration .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\malaysia beastiality voyeur hole .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\french bukkake cum sleeping girly .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\canadian handjob beastiality girls penetration (Ashley,Jade).mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\cum cum voyeur upskirt .mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\mssrv.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\security\templates\chinese fucking beastiality hidden hole femdom (Janette,Melissa).rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\tyrkish nude hot (!) .rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\hardcore beastiality sleeping (Janette).avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\horse beast voyeur (Janette,Sarah).rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\norwegian beast lesbian full movie .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\horse [free] hole (Kathrin,Ashley).mpg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\horse fucking several models castration .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\black sperm sleeping legs latex .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\italian xxx bukkake lesbian shoes .rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\action beastiality several models lady .avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\handjob beastiality hot (!) .zip.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\norwegian blowjob cum [free] .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\indian porn trambling [bangbus] (Jenna,Sylvia).rar.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\nude lingerie big (Sandy,Sarah).avi.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\tyrkish gang bang public mistress .mpeg.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exepid process 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2572 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 2832 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exedescription pid process target process PID 2512 wrote to memory of 2404 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2512 wrote to memory of 2404 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2512 wrote to memory of 2404 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2512 wrote to memory of 2404 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2404 wrote to memory of 2832 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2404 wrote to memory of 2832 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2404 wrote to memory of 2832 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2404 wrote to memory of 2832 2404 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2512 wrote to memory of 2572 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2512 wrote to memory of 2572 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2512 wrote to memory of 2572 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe PID 2512 wrote to memory of 2572 2512 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe 8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"C:\Users\Admin\AppData\Local\Temp\8e3d4c2d2f7790bc97295feb284b856ff53b2bf469c951149652f32bab5698a8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Windows Sidebar\Shared Gadgets\porn animal sleeping beautyfull (Karin,Sarah).avi.exe
Filesize763KB
MD5057896dc32c862a6524fee69a12563e5
SHA1dd7ab93c8845f56c17d612ce59b618867d380930
SHA256c77739512eb6359d731bcd29cd0c4110539af29071f5c502819ae276c95bb760
SHA512eddb09ebedba84b4b75b7edf8ac1b2d8381625511ec4899b424e22f9b372ef3010f841d6d69a277a0810136bd2ca3d2e5fa350b5bcae06c15eb99e4aa6b08d48