Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 23:35
Behavioral task
behavioral1
Sample
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe
Resource
win10v2004-20240226-en
General
-
Target
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe
-
Size
1.4MB
-
MD5
d4b305c852a21d1ab584de43e4890e57
-
SHA1
49657d7126985d800963deb5307caf256c7391e9
-
SHA256
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee
-
SHA512
886cf3f2ccb880a689a265c2499bc645274eff3cfd0348d94aabca67a9569ba2aa46476e4680e46bf0e3f8d278903618e1bb9360e5c125f0ecd74a60b7643dad
-
SSDEEP
24576:A8Ixu8ihxY5A0EDPYYRCsOBAqZ1qddMVKEW/wbvno9DkapTwECTTpThcUB5L:ABMThxYqLY8pOB5HLW/0aDkaFwTqKL
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
Processes:
resource yara_rule behavioral2/memory/2732-162-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-184-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3212-185-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2732-186-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1108-187-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-189-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-190-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-196-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-206-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-210-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-215-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-219-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-223-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-227-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-231-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-235-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-239-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-243-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1216-247-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
Processes:
resource yara_rule behavioral2/memory/1216-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian cumshot hardcore [milf] titts lady .mpg.exe UPX behavioral2/memory/2732-162-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-184-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3212-185-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2732-186-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1108-187-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-189-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-190-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-196-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-206-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-210-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-215-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-219-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-223-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-227-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-231-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-235-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-239-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-243-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1216-247-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1216-0-0x0000000000400000-0x000000000041C000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian cumshot hardcore [milf] titts lady .mpg.exe upx behavioral2/memory/2732-162-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-184-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3212-185-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2732-186-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1108-187-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-189-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-190-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-196-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-206-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-210-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-215-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-219-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-223-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-227-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-231-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-235-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-239-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-243-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1216-247-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exedescription ioc process File opened (read-only) \??\G: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\J: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\L: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\T: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\U: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\E: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\I: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\M: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\O: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\Q: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\V: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\W: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\A: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\B: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\P: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\R: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\S: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\X: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\Y: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\Z: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\H: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\K: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File opened (read-only) \??\N: 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe -
Drops file in System32 directory 12 IoCs
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exedescription ioc process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\bukkake hot (!) (Karin).rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\config\systemprofile\tyrkish gang bang lesbian [free] mistress .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\IME\SHARED\xxx public latex .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lesbian [free] titts .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\brasilian porn lingerie licking .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\System32\DriverStore\Temp\bukkake licking shower (Ashley,Sarah).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\IME\SHARED\black fetish gay catfight (Tatjana).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\russian cum horse masturbation glans .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\FxsTmp\lingerie licking glans .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\config\systemprofile\brasilian gang bang blowjob girls circumcision .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\FxsTmp\gang bang fucking full movie Ôï .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish porn trambling public .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe -
Drops file in Program Files directory 18 IoCs
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exedescription ioc process File created C:\Program Files\Microsoft Office\Updates\Download\italian handjob xxx hidden sm .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\xxx lesbian glans .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Google\Temp\american handjob lingerie public high heels .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\Common Files\microsoft shared\beast full movie .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\Microsoft Office\root\Templates\trambling big stockings (Jenna,Liz).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian cumshot hardcore [milf] titts lady .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\indian porn trambling masturbation traffic .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\italian gang bang sperm several models glans .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Microsoft\Temp\lingerie several models balls .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\dotnet\shared\russian porn fucking masturbation hole balls (Sarah).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\hardcore hot (!) cock femdom .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\xxx masturbation stockings .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Google\Update\Download\swedish animal trambling hot (!) .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\italian animal lingerie [milf] girly .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\danish horse lesbian [bangbus] beautyfull .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\tyrkish porn bukkake licking ,Ó .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\indian horse hardcore sleeping feet hotel .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\brasilian action xxx lesbian glans upskirt .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe -
Drops file in Windows directory 64 IoCs
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\handjob bukkake [bangbus] hole hairy (Sylvia).zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\italian gang bang blowjob girls shower .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\american cumshot fucking [free] feet redhair (Liz).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\PLA\Templates\lingerie uncut glans .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\german horse full movie (Curtney).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\chinese horse masturbation 50+ .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\african blowjob [bangbus] .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\danish porn lingerie girls titts balls (Jade).rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\cum fucking licking titts femdom (Samantha).mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\indian cumshot beast public feet shoes (Sarah).mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\japanese animal horse full movie mature (Christine,Tatjana).rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\spanish beast catfight cock sweet .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\black handjob fucking catfight penetration .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\tyrkish gang bang lesbian voyeur (Janette).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\german gay public feet .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\malaysia beast public (Sylvia).zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\horse lesbian big stockings .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\malaysia beast full movie (Karin).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\tyrkish nude bukkake catfight titts (Sonja,Melissa).mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\beastiality sperm voyeur cock hotel (Sylvia).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\CbsTemp\russian nude xxx [milf] titts castration .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\american handjob bukkake several models fishy .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\indian beastiality bukkake lesbian hole stockings (Samantha).zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\cum xxx big cock sweet .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\action beast full movie .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\blowjob big (Melissa).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\tyrkish kicking fucking hidden feet sweet (Curtney).rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\bukkake masturbation .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\horse public girly .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\russian kicking gay big hole .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\kicking horse big gorgeoushorny .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\trambling [milf] hole .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\indian nude hardcore hidden feet .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\danish handjob gay uncut castration .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\hardcore girls 50+ .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\norwegian trambling [free] Ôï .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\german bukkake voyeur cock mature (Jade).mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\swedish porn lingerie hidden hairy .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\gang bang xxx several models glans hairy .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\action fucking masturbation .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\lingerie catfight traffic .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\trambling public feet pregnant (Janette).rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\german blowjob [bangbus] cock traffic .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\horse [free] femdom .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\hardcore hot (!) glans .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\swedish porn blowjob catfight cock latex (Sylvia).zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\japanese beastiality hardcore hidden shower (Britney,Samantha).zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian fetish trambling lesbian balls .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\african lesbian catfight stockings (Gina,Sarah).avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\fucking full movie feet shower .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\action hardcore full movie feet .avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\kicking trambling [bangbus] girly .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\beastiality beast full movie .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\animal lesbian catfight titts beautyfull .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\american nude lingerie sleeping .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\tyrkish nude lesbian hot (!) cock fishy .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\porn bukkake [milf] cock .mpg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\tyrkish horse horse [milf] hole latex (Liz).avi.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\lesbian masturbation wifey .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\swedish horse blowjob full movie blondie .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\gay sleeping glans traffic (Sylvia).zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\american cum horse lesbian cock Ôï .zip.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\lingerie masturbation glans boots .mpeg.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\action sperm big feet hotel .rar.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exepid process 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1108 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 2732 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exedescription pid process target process PID 1216 wrote to memory of 3212 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 1216 wrote to memory of 3212 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 1216 wrote to memory of 3212 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 1216 wrote to memory of 2732 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 1216 wrote to memory of 2732 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 1216 wrote to memory of 2732 1216 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 3212 wrote to memory of 1108 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 3212 wrote to memory of 1108 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe PID 3212 wrote to memory of 1108 3212 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe 95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
-
C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"C:\Users\Admin\AppData\Local\Temp\95edc01c97160a65dbb213e73bfd48caa10a3f027c4be68749775c6830e820ee.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian cumshot hardcore [milf] titts lady .mpg.exe
Filesize382KB
MD5c01c0240c1a0419c0c7c782228d9454e
SHA1822d5463b3df1a931e9c115b4bfd0f7be8f8f1f8
SHA256d8ade765d492474f03f767effe0c1e6729df98e3d345b1c6b3ddf344ffc99c86
SHA5122d739de3fb8eb15ed59c323f5fea6a3d82ea0a4676cb04e97a7f4aa444709ec15dfb1e1cbbb83ef55732cd7ca368f3d92516aaf34bd8efece7abe191b07093c4