Analysis
- max time kernel
157s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
07/04/2024, 23:58
Behavioral task
behavioral1
Sample
9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe
Resource
win7-20240220-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe
- Size 288KB
- Sample240407-3z5fyaad41
- SHA256 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567
- MD5 99026ba95db7aea610f0a4942dcce5be
- SHA1 f76d366e366010573683293139dc7269a2391a45
- SHA512 abc1e263ff2523f26f8f8da78f2b0ec33a926f3834ed69512d8a6d7e676e58e16325e435f03f8cd0b3a4115eb7b0bac915de31320bf1c995801cbe7b44a0a33e
- SSDEEP 6144:SjluQoSKIo5Rv4wAXK2CzFH1l4xYRLVAG9E4L:SEQoSeTVAwZH4KRpd9E4L
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 5 IoCs
resource yara_rule behavioral2/memory/1052-13-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/5112-163-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3592-167-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1052-168-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4780-170-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral2/memory/5112-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/files/0x000b000000023130-5.dat UPX behavioral2/memory/3592-11-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1052-13-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4780-14-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/5112-163-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3592-167-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1052-168-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4780-170-0x0000000000400000-0x000000000041F000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/5112-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000b000000023130-5.dat upx behavioral2/memory/3592-11-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1052-13-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4780-14-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5112-163-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3592-167-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1052-168-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4780-170-0x0000000000400000-0x000000000041F000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\S: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\T: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\V: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\X: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\E: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\G: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\W: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\Y: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\B: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\Q: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\L: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\R: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\U: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\Z: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\A: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\J: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\K: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\M: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\O: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\P: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\H: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File opened (read-only) \??\I: 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake fetish masturbation hole pregnant (Kathrin).rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\french nude cumshot catfight legs .mpg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\Microsoft Office\Updates\Download\animal animal [free] .mpg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\fetish licking .mpeg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\animal lingerie masturbation boobs .mpeg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\swedish xxx voyeur (Liz,Sylvia).avi.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\french gang bang gay voyeur titts granny .zip.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\asian cumshot cumshot lesbian sm (Tatjana,Samantha).rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian horse lesbian .rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Google\Temp\italian trambling voyeur upskirt .zip.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Google\Update\Download\russian gay animal uncut ash .rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\Common Files\microsoft shared\kicking lesbian uncut swallow (Anniston).zip.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\dotnet\shared\bukkake nude girls feet .avi.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\Microsoft Office\root\Templates\african gang bang sperm lesbian cock bondage .mpeg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\trambling [bangbus] castration (Tatjana).rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\american action full movie hole shower (Gina,Jade).mpg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\chinese horse beast girls .avi.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Program Files (x86)\Microsoft\Temp\lesbian big cock .rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\animal sperm voyeur shower .rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\british nude xxx full movie leather (Curtney,Liz).avi.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\american fucking cumshot licking black hairunshaved .mpeg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\assembly\tmp\russian lesbian hidden hole latex .zip.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian trambling horse sleeping ash .mpeg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\CbsTemp\spanish beastiality action big (Britney).zip.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\InputMethod\SHARED\sperm cumshot [bangbus] (Anniston,Anniston).mpg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore fetish several models latex .avi.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\brasilian gay beastiality big hole young (Gina).zip.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\assembly\temp\horse fetish uncut cock traffic .mpeg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\german cumshot [bangbus] legs sweet (Sonja,Jade).rar.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\Downloaded Program Files\danish horse trambling voyeur .mpeg.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\mssrv.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\action sleeping ash mature (Gina).avi.exe 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 4780 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 1052 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5112 wrote to memory of 3592 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 88 PID 5112 wrote to memory of 3592 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 88 PID 5112 wrote to memory of 3592 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 88 PID 5112 wrote to memory of 1052 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 89 PID 5112 wrote to memory of 1052 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 89 PID 5112 wrote to memory of 1052 5112 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 89 PID 3592 wrote to memory of 4780 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 90 PID 3592 wrote to memory of 4780 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 90 PID 3592 wrote to memory of 4780 3592 9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
-
C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"C:\Users\Admin\AppData\Local\Temp\9ff6c235984814f9b00e0bba350d9dbe7d81b7308f02b96b010427b8961e1567.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake fetish masturbation hole pregnant (Kathrin).rar.exe
- Size 1.5MB
- SHA256 b074a983e187367aec6e73873589da367169cc08bdcdd4e001a7944f0177ba5f
- MD5 8aca7f1dfe32c2574d4e1972c7f68cda
- SHA1 61a53cfdd5bd49de4bc1d6439e4e64802f49eb27
- SHA512 a746c9baed480a767ceed04c1b0665c5eb8e0de4fdde00312c0f38ceffef6e14241c5190d38445c7d8068137496079e636e79f4fc89d0486c0dc9b0d6a69fc2f
- SSDEEP 24576:SRPLZ3yMEW7zRy8x9lsX5Xw3QbiI28T5vCuXt7cGMS46WQyhkNn8TbupmjJ1Tb:iPdHxQJNC2zd7zMaS0pc3
- MD5 SHA1 SHA512 SSDEEP