Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 23:43
Behavioral task
behavioral1
Sample
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe
Resource
win10v2004-20240226-en
General
-
Target
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe
-
Size
135KB
-
MD5
b118995819e705973a392fde50d01d71
-
SHA1
b1cf5c0096aaebaf405879903836c0ae62d5094c
-
SHA256
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b
-
SHA512
4457b0c83ab1273353bcfe1e72a7893042f3b981f4a5ed0ad616bc408af3651513da633117c4a5768e1ea54cc680192d90f9e7d36e0a8adfd0553aeddb3b6816
-
SSDEEP
1536:YRVCaKgzbLc54hukfgvYnouy8oRDEIFm/tb1KQzvwIALByTwsT1nX8BV:gjbLl/gvQoutmrFQtb1TTwdLByUCMBV
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
Processes:
resource yara_rule behavioral2/memory/4912-68-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/740-167-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/884-168-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-187-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-192-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-198-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-209-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-213-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-218-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-222-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-226-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-230-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-234-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-238-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-242-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-246-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-250-0x0000000000400000-0x0000000000420000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 19 IoCs
Processes:
resource yara_rule behavioral2/memory/1828-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\british porn voyeur hole wifey .mpeg.exe UPX behavioral2/memory/4912-68-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/740-167-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/884-168-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-187-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-192-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-198-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-209-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-213-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-218-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-222-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-226-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-230-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-234-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-238-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-242-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-246-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/1828-250-0x0000000000400000-0x0000000000420000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1828-0-0x0000000000400000-0x0000000000420000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\british porn voyeur hole wifey .mpeg.exe upx behavioral2/memory/4912-68-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/740-167-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/884-168-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-187-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-192-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-198-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-209-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-213-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-218-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-222-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-226-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-230-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-234-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-238-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-242-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-246-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1828-250-0x0000000000400000-0x0000000000420000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exedescription ioc process File opened (read-only) \??\S: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\T: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\L: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\N: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\V: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\W: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\X: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\Y: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\E: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\G: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\U: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\H: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\M: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\I: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\J: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\K: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\O: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\P: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\Q: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\A: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\B: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\R: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File opened (read-only) \??\Z: 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe -
Drops file in System32 directory 12 IoCs
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\action uncut titts (Samantha,Tatjana).zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\FxsTmp\cum big pregnant .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\config\systemprofile\malaysia hardcore [free] balls (Janette).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\FxsTmp\asian trambling hot (!) redhair .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\System32\DriverStore\Temp\russian gay full movie .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\IME\SHARED\russian blowjob catfight .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\black kicking beastiality [bangbus] young (Jade,Sarah).rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\handjob xxx sleeping vagina fishy .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\chinese lesbian sleeping .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\IME\SHARED\spanish beastiality sperm licking feet .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\british lesbian cum masturbation girly .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish xxx lingerie hidden boots .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe -
Drops file in Program Files directory 18 IoCs
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exedescription ioc process File created C:\Program Files\dotnet\shared\hardcore full movie sm .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\german kicking full movie (Sonja,Kathrin).avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Microsoft Office\Updates\Download\kicking uncut legs 40+ .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\cumshot lesbian [bangbus] wifey (Sonja,Kathrin).rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\brasilian horse beast [free] YEâPSè& .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Microsoft Office\root\Templates\german action girls boots (Christine,Sylvia).zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian trambling gang bang catfight wifey .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\british xxx catfight granny (Jenna).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Microsoft\Temp\japanese trambling masturbation boobs pregnant .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\french lesbian uncut feet black hairunshaved (Samantha,Sandy).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\asian kicking voyeur boots .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Google\Update\Download\french blowjob hardcore voyeur mature (Curtney).mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Common Files\microsoft shared\beast action big hairy .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\british porn voyeur hole wifey .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\cumshot lesbian black hairunshaved (Britney,Karin).zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\african nude bukkake lesbian .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\italian beastiality lesbian granny .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Program Files (x86)\Google\Temp\norwegian lesbian fucking masturbation legs .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe -
Drops file in Windows directory 64 IoCs
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exedescription ioc process File created C:\Windows\ServiceProfiles\LocalService\Downloads\german horse trambling [free] beautyfull .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\porn lingerie hot (!) beautyfull (Samantha).avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\brasilian nude porn hidden (Sarah).zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\spanish action lesbian young (Christine,Jade).zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\lesbian big (Ashley,Tatjana).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\danish sperm blowjob hot (!) hole .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\security\templates\brasilian gay lingerie [milf] nipples latex .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\italian kicking public vagina boots .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\black porn sleeping boots .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\swedish bukkake catfight swallow .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\african fetish porn uncut vagina high heels .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\canadian fucking handjob several models (Sonja,Sarah).zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\kicking blowjob voyeur legs circumcision .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\french cum trambling full movie .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\american gang bang several models cock 50+ .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\gang bang xxx voyeur (Ashley,Britney).mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\asian trambling public (Tatjana,Samantha).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\tyrkish lesbian voyeur glans traffic .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\horse animal [milf] (Gina,Gina).mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\blowjob kicking voyeur vagina granny .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\japanese trambling [milf] hole .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\gay sperm catfight latex .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\russian action big mature .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\chinese porn full movie bondage .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\malaysia bukkake hardcore public (Anniston,Karin).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\british action action sleeping glans black hairunshaved (Ashley).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\japanese hardcore gang bang licking leather .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\handjob several models wifey .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\french cum uncut .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\animal hidden .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\xxx beast [free] blondie (Sonja,Anniston).mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\lesbian public ash latex .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\french gay lesbian sm .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\fetish action uncut feet .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\porn gay full movie Ôï .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\gay hidden wifey .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\chinese gang bang uncut hole ash (Melissa,Christine).avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\german nude public .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\tyrkish sperm hot (!) cock (Janette).rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\french handjob several models (Sarah).rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\animal voyeur 40+ .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\cum hot (!) .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\american xxx lesbian .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\asian sperm big sm .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\beastiality blowjob girls mistress .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\xxx voyeur hairy .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\horse big hotel .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\german horse kicking uncut .mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\horse cum full movie boobs .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\kicking big vagina stockings .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\beast full movie circumcision .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\british nude [bangbus] .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\japanese blowjob handjob [milf] mature .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\hardcore cumshot voyeur hole stockings .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\danish hardcore handjob big vagina (Gina).mpg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\gay animal girls .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\cumshot masturbation sm .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\porn sleeping shoes .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\french bukkake horse sleeping pregnant (Liz).mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\italian sperm [bangbus] .avi.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\russian cumshot handjob catfight castration .zip.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\gay action big traffic .mpeg.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\porn sperm lesbian (Kathrin).rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\russian hardcore lingerie hot (!) feet high heels .rar.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exepid process 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 884 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 740 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exedescription pid process target process PID 1828 wrote to memory of 4912 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 1828 wrote to memory of 4912 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 1828 wrote to memory of 4912 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 1828 wrote to memory of 740 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 1828 wrote to memory of 740 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 1828 wrote to memory of 740 1828 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 4912 wrote to memory of 884 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 4912 wrote to memory of 884 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe PID 4912 wrote to memory of 884 4912 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe 9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:884
-
-
-
C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"C:\Users\Admin\AppData\Local\Temp\9990ea0e89e97938f0a008090ee7b6909ad68f6dd5b480481dc8ef189b97fb4b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\british porn voyeur hole wifey .mpeg.exe
Filesize1.5MB
MD5ecb565066e7d3cc84bfba907fd129acb
SHA157dea9488fe7851089ee055fbc1c89aca6ab05aa
SHA256e02b9238706fcc46c16c9b12282092ca86c7e52e25020dbcebb303c3a13221ce
SHA512af8b9629acaff2dcb4068dee6050487d416b2046f5257506a12fe983c8dcb82052981931dcb81881810fa6597b71eadd2faeb5c3815971f3d001a69f536842ee