Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 19:22
Behavioral task
behavioral1
Sample
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
Resource
win10v2004-20240226-en
General
-
Target
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
-
Size
1.5MB
-
MD5
bb6f3565fda7bf286ff05635b968f604
-
SHA1
2ad2b3dcec719de014c1c301ce5cb686dea21969
-
SHA256
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b
-
SHA512
82601b58f1e1f3c275f3071dc51d1dae65f53b8523cd130feb0ebbfc0538c48c5ae3a6c50cb5d3c7977d2b6c8e43cbc2a9fc0abbf0c8e81846ff46cdf7bd2faf
-
SSDEEP
24576:V+ejq24CVAHTgRpfkuigAIN4CIipZ7Jwwk6Nmf5NWDNWyIJpNpE0KHWai:Mtq5RpfQG9IijiwkPNGLIJpNuHWj
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
Processes:
resource yara_rule behavioral1/memory/2896-0-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2332-69-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2652-91-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-95-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2332-104-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2652-105-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-106-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-110-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-113-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-116-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-121-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-124-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-127-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-130-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-133-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-136-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-139-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-142-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2896-145-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2896-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian nude fucking public lady .mpg.exe UPX behavioral1/memory/2332-69-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2652-91-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-95-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2332-104-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2652-105-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-106-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-110-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-113-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-116-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-121-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-124-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-127-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-130-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-133-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-136-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-139-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-142-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral1/memory/2896-145-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2896-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian nude fucking public lady .mpg.exe upx behavioral1/memory/2332-69-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2652-91-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-95-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2332-104-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2652-105-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-106-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-110-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-113-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-116-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-121-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-124-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-127-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-130-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-133-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-136-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-139-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-142-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral1/memory/2896-145-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File opened (read-only) \??\E: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\G: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\K: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\L: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\P: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\V: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\X: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\Z: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\J: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\Q: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\T: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\A: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\B: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\I: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\M: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\S: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\W: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\Y: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\H: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\N: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\O: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\R: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\U: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Drops file in System32 directory 10 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File created C:\Windows\SysWOW64\IME\shared\tyrkish action trambling hidden .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\config\systemprofile\russian horse horse girls lady .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian horse bukkake masturbation latex (Sandy,Janette).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\FxsTmp\chinese beast full movie .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\FxsTmp\swedish cum hardcore sleeping (Jade).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\japanese fetish lingerie hot (!) .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\System32\DriverStore\Temp\swedish beastiality lingerie [free] (Samantha).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\IME\shared\danish animal bukkake [bangbus] boots .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\xxx public granny .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\config\systemprofile\tyrkish horse bukkake big penetration .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Drops file in Program Files directory 15 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File created C:\Program Files (x86)\Google\Update\Download\cum xxx masturbation leather .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\bukkake [bangbus] .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\italian action xxx uncut glans .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Windows Journal\Templates\trambling girls shower .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\brasilian nude fucking public lady .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Google\Temp\indian handjob sperm [free] titts ìï (Sylvia).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Common Files\Microsoft Shared\japanese beastiality lingerie masturbation hole young .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\DVD Maker\Shared\bukkake lesbian (Tatjana).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\horse [free] hole blondie .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\russian cumshot sperm hot (!) swallow .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\danish cumshot xxx full movie (Samantha).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\danish nude blowjob [bangbus] hole granny (Tatjana).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\gay catfight feet hotel (Melissa).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\swedish kicking bukkake [milf] hole latex .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft Office\Templates\american gang bang bukkake [milf] cock .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Drops file in Windows directory 64 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\british sperm catfight .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\russian gang bang blowjob girls feet .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\blowjob hidden (Melissa).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\malaysia sperm hidden stockings .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\japanese cum blowjob sleeping sweet (Kathrin,Sylvia).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\danish kicking trambling sleeping .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\lesbian catfight upskirt .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\danish kicking gay [milf] feet .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\indian porn hardcore hot (!) (Curtney).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\action gay hot (!) hole ash .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\Downloaded Program Files\indian kicking gay full movie (Jade).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\blowjob big cock (Sandy,Sylvia).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\norwegian blowjob public glans castration (Liz).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\kicking beast sleeping 40+ (Kathrin,Sarah).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\tmp\italian horse lesbian several models glans penetration .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\kicking hardcore [milf] feet (Sandy,Sarah).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\Temp\russian gang bang xxx licking .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish animal trambling girls hole mistress .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish horse sperm [milf] glans .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\beast licking redhair .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\swedish nude hardcore girls shower .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\hardcore [milf] (Tatjana).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\russian handjob lesbian licking shoes .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\japanese gang bang lingerie [milf] cock shower .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\danish beastiality gay hot (!) cock penetration .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\nude blowjob hidden girly .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\french lesbian public .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\french fucking public .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\african beast voyeur ìï .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\african sperm lesbian feet shower .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\canadian sperm licking glans blondie .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\swedish handjob lesbian catfight young (Sandy,Sylvia).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\asian trambling sleeping .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\kicking lesbian [milf] hole redhair (Janette).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\beast full movie cock gorgeoushorny .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\black handjob gay masturbation mistress .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\horse masturbation hole .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\horse sperm licking young (Sonja,Janette).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\PLA\Templates\danish cumshot trambling sleeping cock pregnant .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\cum lesbian big glans .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\nude bukkake [free] gorgeoushorny .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\norwegian trambling public swallow .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\trambling catfight mistress .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian full movie hole (Sonja,Liz).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\gang bang horse uncut feet boots (Karin).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\action lesbian masturbation titts 50+ .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\british lingerie [bangbus] .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\tyrkish action gay uncut latex (Kathrin,Sylvia).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\fetish sperm catfight glans mature (Tatjana).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\cumshot horse several models cock .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\danish beastiality lingerie several models titts high heels (Liz).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\british xxx big (Samantha).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\french horse full movie (Tatjana).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\beast several models .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\InstallTemp\horse xxx uncut glans high heels (Tatjana).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\tyrkish cum gay full movie ash .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\swedish kicking xxx voyeur .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\spanish gay masturbation .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\spanish bukkake lesbian cock ìï (Melissa).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\temp\indian fetish horse sleeping leather .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\beastiality lingerie licking glans .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\japanese porn beast voyeur .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\trambling big (Janette).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\cum xxx hidden .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exepid process 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2652 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription pid process target process PID 2896 wrote to memory of 2332 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 2896 wrote to memory of 2332 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 2896 wrote to memory of 2332 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 2896 wrote to memory of 2332 2896 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 2332 wrote to memory of 2652 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 2332 wrote to memory of 2652 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 2332 wrote to memory of 2652 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 2332 wrote to memory of 2652 2332 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD52739f0b9b3ebd4ebd373471710651af2
SHA12c1f6b717677bf163483df14cdf8bdb7857f5656
SHA256d567617e2b8446cf4f49fc791b07fad884f70933c63317f2569dbdeb657fb725
SHA5123ca5c958a912a520a9b7ccd87d4b30539e057acdd6da9dd0d0ae73f2624d772169c68566954de11d32a8e6bd5ac9af09aebeecff5fbe90c69a743fbc1e3a5f73
-
Filesize
183B
MD517d55eb7544df25c0c804034d5eb4cb4
SHA1da4de13868a3e9b37fa8974667c6e8cd715431e5
SHA2562a295f3e7a3b780ce43f83c4927931ce1899c8f10958c71098ba249049389e5d
SHA512244f90e6410a4a9cf4bc897f9b0de16a8e5533c3849e8660c8dde33f7a70d358a41cd8994bb48c82289f92cdd46397f3e8e499317fb1a60b9ceaa99b3afc7860