Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 19:22
Behavioral task
behavioral1
Sample
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
Resource
win10v2004-20240226-en
General
-
Target
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
-
Size
1.5MB
-
MD5
bb6f3565fda7bf286ff05635b968f604
-
SHA1
2ad2b3dcec719de014c1c301ce5cb686dea21969
-
SHA256
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b
-
SHA512
82601b58f1e1f3c275f3071dc51d1dae65f53b8523cd130feb0ebbfc0538c48c5ae3a6c50cb5d3c7977d2b6c8e43cbc2a9fc0abbf0c8e81846ff46cdf7bd2faf
-
SSDEEP
24576:V+ejq24CVAHTgRpfkuigAIN4CIipZ7Jwwk6Nmf5NWDNWyIJpNpE0KHWai:Mtq5RpfQG9IijiwkPNGLIJpNuHWj
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
Processes:
resource yara_rule behavioral2/memory/1096-71-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2952-156-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-181-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1096-182-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2504-184-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-186-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-187-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-193-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-203-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-207-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-212-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-216-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-220-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-224-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-228-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-232-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-236-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-240-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3920-244-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 22 IoCs
Processes:
resource yara_rule behavioral2/memory/3920-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\porn [milf] leather .mpeg.exe UPX behavioral2/memory/1096-71-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2952-156-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2504-157-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-181-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1096-182-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2504-184-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-186-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-187-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-193-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-203-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-207-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-212-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-216-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-220-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-224-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-228-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-232-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-236-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-240-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3920-244-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/3920-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\porn [milf] leather .mpeg.exe upx behavioral2/memory/1096-71-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2952-156-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2504-157-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-181-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1096-182-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2504-184-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-193-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-203-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-207-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-212-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-216-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-220-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-224-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-228-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-232-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-236-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-240-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3920-244-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File opened (read-only) \??\S: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\W: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\X: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\Z: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\I: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\J: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\H: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\M: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\P: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\Q: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\E: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\G: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\A: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\Y: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\L: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\N: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\O: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\R: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\T: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\U: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\B: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\K: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File opened (read-only) \??\V: 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Drops file in System32 directory 12 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File created C:\Windows\SysWOW64\IME\SHARED\asian porn [milf] (Kathrin,Tatjana).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\IME\SHARED\bukkake big .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\horse horse masturbation boobs upskirt .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\System32\DriverStore\Temp\cum [bangbus] mature .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\FxsTmp\indian porn full movie legs (Sarah).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\canadian lingerie fucking uncut (Tatjana).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish blowjob cumshot [free] vagina .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\beastiality fucking lesbian (Liz).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\config\systemprofile\danish animal cumshot lesbian ash 40+ (Anniston,Gina).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\FxsTmp\hardcore voyeur nipples .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian kicking public hole .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese action licking ¼ë .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Drops file in Program Files directory 18 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\african horse voyeur redhair (Kathrin).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Google\Temp\chinese hardcore full movie redhair (Karin,Jenna).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fucking lesbian vagina high heels .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Microsoft\Temp\italian nude catfight granny .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Common Files\microsoft shared\lingerie big .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Microsoft Office\root\Templates\porn porn licking ¼ë .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gang bang full movie ash shower .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Google\Update\Download\swedish cumshot [bangbus] cock .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\dotnet\shared\cumshot nude masturbation mature .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Microsoft Office\Updates\Download\french kicking animal licking feet YEâPSè& .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\danish porn fucking masturbation .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\norwegian kicking catfight Œã .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\german trambling cumshot lesbian femdom .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\american horse masturbation .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\chinese horse catfight vagina traffic .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\porn [milf] leather .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\british trambling fetish [bangbus] mistress .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\german fucking nude masturbation (Kathrin).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Drops file in Windows directory 64 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\chinese fetish catfight blondie (Jenna,Britney).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\italian kicking voyeur mature (Anniston,Curtney).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\norwegian action gay voyeur .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black nude trambling licking nipples hotel .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\spanish blowjob sperm girls boobs .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\beast trambling licking glans .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\swedish beast voyeur glans .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\french trambling several models swallow .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\british kicking voyeur .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\lesbian hidden (Jade,Melissa).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\mssrv.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\indian sperm big castration (Sonja,Sandy).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\handjob [bangbus] feet .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\american porn beastiality several models glans 40+ (Janette,Kathrin).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\nude animal catfight bondage (Christine).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\asian cum girls boobs blondie (Gina,Liz).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\indian cumshot cum big vagina balls (Janette).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\lesbian lesbian uncut (Sandy,Gina).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\nude girls (Anniston).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\beastiality licking black hairunshaved .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\indian fucking fetish big beautyfull (Jenna,Sylvia).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\horse trambling hot (!) upskirt (Jenna,Curtney).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\swedish xxx beast [milf] feet .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\malaysia beast girls upskirt .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\gay [bangbus] .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\cumshot hidden .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\british blowjob trambling hidden redhair (Samantha).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\trambling porn masturbation .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\chinese porn lingerie sleeping nipples traffic .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\asian horse [milf] nipples granny .mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\horse [free] hole wifey (Anniston).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\gang bang blowjob big cock shower (Sandy).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\russian hardcore kicking masturbation legs .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\french kicking public ash high heels .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\french trambling action [milf] cock stockings (Sylvia,Jenna).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\italian cumshot lesbian balls (Samantha).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\sperm voyeur blondie .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\swedish cumshot voyeur cock femdom (Jenna,Kathrin).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\fetish porn hidden .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\chinese sperm horse [bangbus] sweet .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\norwegian kicking lesbian hot (!) ash (Sonja).rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\british blowjob trambling hot (!) .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\porn several models redhair (Britney,Gina).avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\african xxx lesbian big latex (Janette,Sonja).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\norwegian gang bang beast full movie gorgeoushorny .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\malaysia beast [free] latex .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian fucking gang bang several models (Karin,Janette).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\xxx lesbian feet ash (Liz,Liz).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\cumshot [free] circumcision .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\porn action uncut gorgeoushorny (Ashley).mpg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\danish animal [milf] .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\swedish blowjob lingerie hidden hole Ôï .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\german bukkake full movie pregnant .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\swedish hardcore hardcore lesbian lady .mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\spanish trambling lingerie licking (Samantha).zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\nude several models (Sarah,Janette).mpeg.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\german hardcore beast sleeping titts balls .rar.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\nude animal voyeur bedroom .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\nude hot (!) bedroom .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\trambling fucking hot (!) penetration .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\cum beastiality girls .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\german action cumshot lesbian shoes .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\japanese gay girls black hairunshaved .zip.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\gay sperm hot (!) .avi.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exepid process 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2504 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2952 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exedescription pid process target process PID 3920 wrote to memory of 1096 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 3920 wrote to memory of 1096 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 3920 wrote to memory of 1096 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 3920 wrote to memory of 2952 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 3920 wrote to memory of 2952 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 3920 wrote to memory of 2952 3920 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 1096 wrote to memory of 2504 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 1096 wrote to memory of 2504 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe PID 1096 wrote to memory of 2504 1096 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe 2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504
-
-
-
C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"C:\Users\Admin\AppData\Local\Temp\2342142f2dfff7a8968deb05c97ea98717197a67d5c65c192ef60c26ede5094b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\porn [milf] leather .mpeg.exe
Filesize2.0MB
MD5fc501d60de978e826b52494e83f9cc0f
SHA12fd651d273490391e21e4a6dedab5a7e01b90e1a
SHA2565bfeb50b2593ef710ac9156d2ff588bb3117eaf4b917b2cb14001765fc358a62
SHA5122fbce098152c61699a31147e587fa948f95af2b29de0488b37c191e0c2c6ac3b4d97b3ab835e9701c4a15378f23cada2dd75affd88f271cfcae8072cdf1e40fd