Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 20:20
Behavioral task
behavioral1
Sample
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe
Resource
win10v2004-20240226-en
General
-
Target
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe
-
Size
378KB
-
MD5
2308c84cfdddb9532b07ca8925ada832
-
SHA1
c7875afe686c4deb209bea98ab720d239c70c485
-
SHA256
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7
-
SHA512
6085f70660c20e675770e8547482f3f96e22e56ccd070236dc49d00ba020f781577841e4e8b687ed301875ac85abce7d284058cc3a556df3da424bb13ae1a817
-
SSDEEP
6144:VjluQoSv4DSIo5R4nM/40yZPNoCb0zYW9mNCng9JKaHpBmIWaNqJqxRvkxbtC1aT:VEQoSfqTt0sWsqgmaHjmIWaNBysuqIDf
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 18 IoCs
Processes:
resource yara_rule behavioral2/memory/2964-33-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3336-39-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1292-145-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2676-146-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-147-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-148-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-152-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-177-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-187-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-191-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-195-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-199-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-204-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-209-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-223-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-227-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-231-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2964-235-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
Processes:
resource yara_rule behavioral2/memory/2964-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\italian beastiality xxx licking titts circumcision .mpg.exe UPX behavioral2/memory/2676-10-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-33-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3336-39-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1292-145-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2676-146-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-147-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-148-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-152-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-177-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-187-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-191-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-195-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-199-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-204-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-209-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-223-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-227-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-231-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2964-235-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2964-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\italian beastiality xxx licking titts circumcision .mpg.exe upx behavioral2/memory/2676-10-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-33-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3336-39-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1292-145-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2676-146-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-147-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-148-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-152-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-177-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-191-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-195-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-199-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-204-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-209-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-223-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-227-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-231-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2964-235-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exedescription ioc process File opened (read-only) \??\R: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\W: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\X: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\B: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\E: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\O: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\P: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\T: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\G: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\H: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\L: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\M: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\Z: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\I: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\K: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\N: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\U: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\V: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\Y: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\A: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\J: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\Q: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File opened (read-only) \??\S: 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe -
Drops file in System32 directory 12 IoCs
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exedescription ioc process File created C:\Windows\SysWOW64\IME\SHARED\trambling [free] cock sweet .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish cumshot blowjob girls (Tatjana).rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\beast lesbian cock (Sonja,Melissa).mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\System32\DriverStore\Temp\trambling masturbation hole .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\FxsTmp\russian porn trambling lesbian titts circumcision .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\indian beastiality fucking uncut .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\config\systemprofile\beast girls swallow .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\FxsTmp\lingerie girls titts .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\IME\SHARED\beast uncut blondie .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\italian kicking bukkake masturbation stockings .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SysWOW64\config\systemprofile\beast [milf] balls .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\danish fetish beast [milf] .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe -
Drops file in Program Files directory 18 IoCs
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Temp\tyrkish beastiality bukkake sleeping .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black gang bang blowjob girls castration .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\american porn xxx [bangbus] glans stockings (Sylvia).mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\fetish blowjob uncut stockings (Gina,Melissa).zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files (x86)\Google\Update\Download\gay catfight titts latex .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\italian beastiality xxx licking titts circumcision .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\japanese nude horse licking (Melissa).avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Microsoft Office\Updates\Download\italian porn horse public stockings .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\swedish gang bang lingerie several models hole upskirt .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\danish porn lingerie [free] stockings .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files (x86)\Google\Temp\indian cumshot bukkake voyeur feet sm .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Common Files\microsoft shared\tyrkish animal lesbian hidden .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\dotnet\shared\lesbian masturbation (Jade).avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Microsoft Office\root\Templates\beast sleeping ¼ë .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake several models (Samantha).mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\russian animal trambling masturbation .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\sperm voyeur castration (Ashley,Curtney).rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\brasilian porn sperm [milf] ash .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe -
Drops file in Windows directory 64 IoCs
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exedescription ioc process File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\black fetish bukkake licking .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\spanish lesbian [milf] hairy (Jenna,Samantha).zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\tyrkish action lesbian [bangbus] hole 40+ (Janette).mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\black cum trambling [free] fishy .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\horse catfight hairy .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\french gay uncut hole black hairunshaved (Melissa).mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\beastiality lingerie public penetration .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\british gay several models high heels (Sonja,Melissa).avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\indian gang bang beast [bangbus] (Jade).rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\security\templates\russian gang bang lingerie lesbian .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\chinese lesbian sleeping titts pregnant .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\norwegian fucking masturbation hole upskirt .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\american cumshot trambling hidden mistress .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\chinese lingerie catfight .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\black horse bukkake girls circumcision .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\tyrkish kicking lesbian full movie hole .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\french trambling several models latex .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\spanish lesbian [bangbus] pregnant .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\danish nude gay voyeur (Melissa).rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\beastiality hardcore big hole blondie .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\swedish beastiality lingerie girls .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\PLA\Templates\indian cumshot trambling masturbation hole leather (Liz).mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\italian gang bang beast full movie cock .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\hardcore lesbian (Samantha).mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\russian cumshot gay full movie castration (Sonja,Sylvia).mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\indian animal hardcore lesbian circumcision .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\horse beast sleeping titts traffic (Samantha).mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\norwegian xxx big girly .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\chinese bukkake [milf] glans ejaculation (Sarah).zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lesbian masturbation glans (Sonja,Samantha).zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\canadian sperm big granny .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\blowjob girls .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\tyrkish cum lingerie [free] girly .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\beastiality beast voyeur (Tatjana).zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\sperm catfight cock hotel .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\beastiality beast full movie hairy .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\brasilian cum bukkake several models .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\german xxx hot (!) .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\bukkake hidden leather .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\indian horse xxx catfight cock hotel .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\british gay full movie .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\nude lingerie several models YEâPSè& .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\black fetish blowjob public ash .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\CbsTemp\american gang bang fucking girls granny .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\Downloaded Program Files\danish gang bang gay voyeur bedroom .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\swedish cum bukkake several models high heels .mpg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\japanese handjob fucking sleeping titts shoes (Samantha).avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\spanish trambling girls cock young (Samantha).rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\swedish fetish trambling full movie swallow .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\assembly\tmp\gay lesbian feet traffic .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian fetish gay [bangbus] titts femdom (Janette).mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\norwegian blowjob hot (!) Ôï .zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\assembly\temp\fucking public sweet (Anniston,Samantha).rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\bukkake licking titts lady .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\beastiality blowjob hidden 40+ .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\gang bang horse public feet .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\japanese cum beast hot (!) hole .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\xxx catfight hole 50+ (Samantha).zip.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\sperm masturbation titts (Britney,Sarah).rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\beast big titts mistress .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\handjob sperm several models glans circumcision .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\asian sperm [free] .avi.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\hardcore [bangbus] .mpeg.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\japanese horse bukkake hot (!) leather .rar.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exepid process 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 2676 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 1292 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exedescription pid process target process PID 2964 wrote to memory of 3336 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 2964 wrote to memory of 3336 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 2964 wrote to memory of 3336 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 2964 wrote to memory of 1292 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 2964 wrote to memory of 1292 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 2964 wrote to memory of 1292 2964 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 3336 wrote to memory of 2676 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 3336 wrote to memory of 2676 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe PID 3336 wrote to memory of 2676 3336 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe 3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"C:\Users\Admin\AppData\Local\Temp\3f1410f25bf8713d59ed908f654e83ae29b4115abfb661a047f2c2bb025463b7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\italian beastiality xxx licking titts circumcision .mpg.exe
Filesize1.8MB
MD5114afdfab6bd1ce579d3e1b5a622ecb9
SHA1dd961b75c8f8a652f6c3bb4687e9829770fd8145
SHA256becb15c9dd22547e72bbf0dd848912a20d82a71a9cb4c7e5a46f1cc710929739
SHA5123c744ac79ffa4a11a01868acd0b85866c79b80efded1ef9e7d3d2605674b6712d770038d4ff48411d328602ea758f97d5a1ed71f9892d85f46223d08df4561e4