Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 23:42
Behavioral task
behavioral1
Sample
998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe
- Size 87KB
- Sample240407-3qgnhsaa8t
- SHA256 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4
- MD5 250890c01873b553db5f11771cc079a6
- SHA1 17d2c3e69a885f032cf618a109e763537e0361b9
- SHA512 370b9f524a1759ab50395306b47059726af0c709dbd3041a4fdb3305a9270a433d68e3bc259d5052f9bb726914965cee97335332d682618442e368e6258f6c9b
- SSDEEP 1536:YRVCaKgzbLc54hukfgvYnouy8rV1Ayj4m/QWR/RBMR:gjbLl/gvQoutp1Tj4mYWR/RY
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 18 IoCs
resource yara_rule behavioral2/memory/4912-163-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2176-162-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-180-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4132-181-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4912-183-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-185-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-191-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-201-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-205-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-210-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-214-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-218-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-222-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-226-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-230-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-234-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-238-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1628-242-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/memory/1628-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/files/0x0004000000022cd2-5.dat UPX behavioral2/memory/4132-87-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4912-163-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/2176-162-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-180-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4132-181-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/4912-183-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-185-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-191-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-201-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-205-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-210-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-214-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-218-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-222-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-226-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-230-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-234-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-238-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1628-242-0x0000000000400000-0x0000000000420000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1628-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0004000000022cd2-5.dat upx behavioral2/memory/4132-87-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4912-163-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2176-162-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-180-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4132-181-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4912-183-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-185-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-191-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-201-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-205-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-210-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-214-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-218-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-222-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-226-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-230-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-234-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-238-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1628-242-0x0000000000400000-0x0000000000420000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\Y: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\O: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\V: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\N: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\Q: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\S: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\T: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\W: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\E: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\H: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\R: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\U: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\Z: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\B: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\M: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\I: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\J: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\K: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\L: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\P: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\A: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File opened (read-only) \??\G: 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\lingerie [milf] (Sylvia).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\FxsTmp\tyrkish action lesbian hidden feet .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\System32\DriverStore\Temp\bukkake voyeur glans penetration .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\IME\SHARED\spanish xxx hidden .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\italian cumshot lingerie masturbation (Melissa).avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\sperm catfight tß .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\IME\SHARED\xxx full movie fishy .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian horse blowjob [free] young .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american beastiality xxx [bangbus] cock sweet .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\config\systemprofile\indian porn horse full movie wifey (Sonja,Sylvia).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SysWOW64\FxsTmp\asian lesbian catfight YEâPSè& (Ashley,Tatjana).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\russian handjob hardcore lesbian titts .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fucking lesbian hotel (Sonja,Melissa).zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\indian horse fucking girls titts .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\Microsoft Office\Updates\Download\danish action xxx [bangbus] (Janette).mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\russian kicking gay uncut cock ash (Karin).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Google\Update\Download\american nude blowjob catfight hotel .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian fetish fucking voyeur feet ash (Sylvia).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\Microsoft Office\root\Templates\horse big .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Google\Temp\tyrkish horse sperm masturbation balls (Jenna,Jade).zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fucking licking hotel .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Microsoft\Temp\russian kicking lingerie full movie hole .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\dotnet\shared\italian fetish beast public femdom .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian action fucking masturbation lady (Kathrin,Sarah).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\norwegian bukkake [bangbus] glans sm .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\beast sleeping cock latex (Janette).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\horse catfight mistress .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\Common Files\microsoft shared\bukkake girls .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\blowjob public titts penetration (Karin).zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\japanese handjob bukkake [bangbus] hotel .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\italian kicking bukkake girls titts balls .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\japanese cumshot beast several models stockings (Christine,Liz).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\danish beastiality fucking uncut cock .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\danish beastiality xxx hot (!) upskirt .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\asian fucking hidden fishy (Anniston,Tatjana).rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\hardcore [bangbus] pregnant .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\bukkake lesbian .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\italian gang bang blowjob several models circumcision .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\british blowjob several models hole young .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\spanish horse sleeping upskirt .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\brasilian animal horse lesbian 40+ (Sandy,Tatjana).avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\canadian trambling [milf] (Janette).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\handjob fucking licking sm .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\SoftwareDistribution\Download\swedish fetish xxx [free] cock boots .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\french horse big circumcision .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\british fucking lesbian (Curtney).zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\nude hardcore [free] .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\CbsTemp\indian gang bang lingerie hot (!) titts traffic (Melissa).mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\xxx girls cock 50+ .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\porn xxx licking YEâPSè& .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\porn lesbian [free] .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\norwegian fucking licking cock .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\brasilian handjob xxx big feet pregnant (Tatjana).avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\spanish xxx girls glans gorgeoushorny .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\xxx uncut swallow .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\chinese trambling licking glans femdom (Samantha).rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\indian cumshot beast masturbation feet .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\norwegian blowjob hidden .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\tyrkish porn blowjob catfight balls .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\american kicking beast several models feet .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\cumshot hardcore hidden cock fishy (Karin).avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\beastiality fucking licking titts .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\cumshot gay girls .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\beastiality lesbian voyeur (Liz).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish action blowjob hot (!) cock granny .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\asian xxx uncut sm (Jenna,Samantha).avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\beast public fishy .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\norwegian lesbian lesbian (Tatjana).rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\mssrv.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\norwegian horse public 40+ (Ashley,Tatjana).rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\fetish gay catfight granny .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\indian porn sperm several models leather .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\porn sperm catfight (Jade).zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_d58d4747b1d5988c\indian horse trambling [milf] (Jade).zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\tyrkish kicking trambling masturbation bedroom .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\malaysia lesbian [free] shower .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\british sperm lesbian sweet .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\gang bang lingerie [milf] cock young (Liz).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\spanish xxx [free] feet (Sonja,Karin).avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\russian cum horse sleeping stockings .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\beast sleeping titts (Jenna,Liz).mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\malaysia fucking hidden hole hairy .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\assembly\tmp\american cumshot lesbian catfight .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\horse xxx lesbian swallow .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\cum lesbian girls .mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\trambling uncut cock YEâPSè& (Liz).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\porn horse masturbation mature .avi.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\african bukkake catfight hole bedroom (Curtney).rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\sperm [bangbus] .rar.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\asian blowjob sleeping young .mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\norwegian xxx hot (!) redhair .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\fucking [milf] cock (Gina,Sarah).mpeg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\lesbian [bangbus] glans balls (Karin).mpg.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\chinese lingerie girls upskirt .zip.exe 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4912 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 2176 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1628 wrote to memory of 4132 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 90 PID 1628 wrote to memory of 4132 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 90 PID 1628 wrote to memory of 4132 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 90 PID 1628 wrote to memory of 2176 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 95 PID 1628 wrote to memory of 2176 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 95 PID 1628 wrote to memory of 2176 1628 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 95 PID 4132 wrote to memory of 4912 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 96 PID 4132 wrote to memory of 4912 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 96 PID 4132 wrote to memory of 4912 4132 998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
-
C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"C:\Users\Admin\AppData\Local\Temp\998c67644f4a053595afc95d9b03fb4ac5c98267735fcd99e535e2f67cec61e4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian fetish fucking voyeur feet ash (Sylvia).mpeg.exe
- Size 1.1MB
- SHA256 768197d831b671237d248860c184af856ed247d569d465eb7325dff99a8729d0
- MD5 c3b65935f0fa24d4fa12590937d20040
- SHA1 7e050eadd36fe0f9c5fc7671a4c8c7256474e768
- SHA512 6be8ebd8b0124b3fe4846079249e29d1f476d46cf6877f70946986d24fdbdaa1122c4455af7ec48cbc1431b8d4afe8ff5448dc033f1cd9e2a72d106f56fffd1e
- SSDEEP 24576:ge2WtL+ROsDs6DqHsMswDxan5AP5Y8ZIknb4Z7lLDOL5gFFt:QWtL0D7Ss+NK5Sm8SAb4Z7RDOLKl
- MD5 SHA1 SHA512 SSDEEP