Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 20:25
Behavioral task
behavioral1
Sample
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe
Resource
win10v2004-20240226-en
General
-
Target
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe
-
Size
1.7MB
-
MD5
687e7e1cdc0674a6fdedd527bf26622e
-
SHA1
e7ed836fbd826fd5b1562076c29de1921ca0c550
-
SHA256
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8
-
SHA512
d81c9dc5449e0cc27341d51de25d268ec3e0ddf01ccb7809a695190e80bfd26d6ffcc0562ff62db1393673563d3327f5c573efd21ef96eaab626c9f41248c56d
-
SSDEEP
24576:V8AIu2bQyTAkvkyhq85iMAMShLXktKNIGpXH/u2eBg1gxjm9KVqvTy/6:ypfVMtywdMCk5MvX0gCS
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
Processes:
resource yara_rule behavioral2/memory/2584-23-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-146-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4740-179-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2584-186-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3412-187-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-188-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-189-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-193-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-197-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-202-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-208-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-218-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-222-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-227-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-231-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-235-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-239-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-243-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2772-247-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
Processes:
resource yara_rule behavioral2/memory/2772-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian beastiality full movie hairy .mpg.exe UPX behavioral2/memory/2584-23-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-146-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4740-179-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2584-186-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3412-187-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-188-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-189-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-193-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-197-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-202-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-208-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-218-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-222-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-227-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-231-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-235-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-239-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-243-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2772-247-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2772-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian beastiality full movie hairy .mpg.exe upx behavioral2/memory/2584-23-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-146-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4740-179-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2584-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3412-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-189-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-193-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-197-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-202-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-208-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-218-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-222-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-227-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-231-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-235-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-239-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-243-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2772-247-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exedescription ioc process File opened (read-only) \??\J: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\O: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\X: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\Y: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\G: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\K: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\P: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\W: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\Z: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\A: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\B: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\E: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\I: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\N: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\Q: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\R: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\U: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\V: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\H: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\L: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\M: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\S: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File opened (read-only) \??\T: 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe -
Drops file in System32 directory 12 IoCs
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exedescription ioc process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\indian gay hidden .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\chinese gay cumshot [bangbus] mature .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\config\systemprofile\hardcore hidden nipples latex .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian cum girls mature (Jenna,Christine).avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\tyrkish hardcore voyeur boobs young .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\blowjob lingerie uncut ash .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\config\systemprofile\malaysia blowjob catfight titts penetration .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\FxsTmp\indian porn trambling public upskirt (Britney,Anniston).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\IME\SHARED\gay masturbation cock sweet (Ashley).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\System32\DriverStore\Temp\italian gay beast hidden girly .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\FxsTmp\cumshot trambling full movie .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\SysWOW64\IME\SHARED\cumshot lingerie big .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe -
Drops file in Program Files directory 19 IoCs
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\spanish nude hidden (Sonja).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\Microsoft Office\Updates\Download\tyrkish action animal [free] 50+ (Curtney).mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\horse handjob masturbation pregnant .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian porn blowjob full movie ash .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian beastiality full movie hairy .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\beastiality full movie .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american beast licking glans leather .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\horse kicking voyeur (Britney,Sylvia).mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\german action trambling lesbian swallow .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Microsoft\Temp\EU5927.tmp\african handjob uncut bedroom .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\gang bang big .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\hardcore public boobs beautyfull .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Microsoft\Temp\chinese blowjob several models penetration .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\dotnet\shared\blowjob lesbian titts .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files\Microsoft Office\root\Templates\horse girls beautyfull (Christine,Ashley).mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\nude several models .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\spanish lesbian masturbation lady (Gina).avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Google\Temp\american action horse hot (!) glans (Sonja,Karin).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Program Files (x86)\Google\Update\Download\tyrkish sperm lesbian ¼ë .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe -
Drops file in Windows directory 64 IoCs
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\action lingerie sleeping swallow .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\german animal sperm sleeping .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\cum big vagina balls (Anniston,Melissa).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\french cum several models .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\indian beastiality bukkake uncut .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\swedish lingerie gang bang [free] nipples ejaculation .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\chinese fucking [bangbus] .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\russian horse beastiality full movie (Janette).rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\cum sperm voyeur (Ashley).avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\chinese cumshot [free] .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\fetish uncut boobs ejaculation .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\danish gay lesbian lesbian (Janette).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\asian porn hidden traffic (Samantha).mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\animal public legs .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\action cumshot masturbation (Kathrin).mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\black porn [free] boobs ash .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\fucking handjob masturbation .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\handjob cum [free] .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\asian lesbian lingerie [milf] .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\danish gay sperm sleeping high heels (Christine).mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\gay beast [milf] nipples pregnant .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\chinese hardcore voyeur legs .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\asian handjob licking granny .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\CbsTemp\beast fucking catfight gorgeoushorny .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\trambling animal hidden upskirt (Sylvia).mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\black cumshot several models .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\sperm [free] latex (Sonja).avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\InstallTemp\german trambling [milf] .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\gay gay [bangbus] (Jenna,Christine).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\asian sperm xxx hidden boots .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\gang bang big boobs (Ashley).rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\trambling licking .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\sperm masturbation ejaculation .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\norwegian handjob [milf] hotel .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\malaysia hardcore public vagina (Janette).zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\italian trambling beast hot (!) ash .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\bukkake fucking masturbation hotel .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\trambling full movie vagina boots .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\PLA\Templates\horse girls mature (Sarah,Melissa).mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\tyrkish lingerie voyeur .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\cumshot lingerie [free] shower .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\russian lingerie [free] penetration .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\russian gay trambling sleeping castration .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\porn masturbation nipples .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\trambling several models circumcision (Melissa).rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\gay kicking [milf] legs boots (Tatjana,Karin).mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\cum animal full movie bedroom .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\gang bang beast [bangbus] vagina girly (Jade).rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\russian cumshot hardcore sleeping .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\hardcore several models beautyfull (Britney).avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\spanish porn full movie ash .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\lesbian cum voyeur leather (Sandy,Tatjana).avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\norwegian lingerie [free] glans blondie .avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\american nude horse hot (!) bedroom .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\animal masturbation .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\gay handjob hot (!) feet femdom .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\horse lesbian Ôï .zip.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\german horse full movie (Britney).mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\gang bang sleeping .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\american bukkake hot (!) shoes .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\kicking sleeping vagina leather .rar.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\japanese cumshot big swallow .mpg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_10.0.19041.1_none_096bb4dc0d5d63a0\beastiality [bangbus] (Ashley,Karin).avi.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\danish xxx gang bang hidden vagina .mpeg.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exepid process 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 3412 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 2584 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exedescription pid process target process PID 2772 wrote to memory of 4740 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 2772 wrote to memory of 4740 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 2772 wrote to memory of 4740 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 2772 wrote to memory of 2584 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 2772 wrote to memory of 2584 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 2772 wrote to memory of 2584 2772 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 4740 wrote to memory of 3412 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 4740 wrote to memory of 3412 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe PID 4740 wrote to memory of 3412 4740 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe 414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"C:\Users\Admin\AppData\Local\Temp\414cc1043a75533bdd96146a24d3186447a286846c1afe4992ad6ffa8d0532e8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\indian beastiality full movie hairy .mpg.exe
Filesize689KB
MD562d7b9a8c4686fd2dace95c3727fb86a
SHA17c8938c6d2d8db9cff64c8662ada21972953e570
SHA256b6d8da5883d556d4c39a56d2ffa5f1714015f492f34b0a722730bce0aee65f36
SHA512bcf288d6c95770d464fb648ec99d5b7f74f7d25c44173e7f49b143a960499e252f1f29f09573e67cc2ae2e9d8d9e117e1fc8401922c873b851b041d72e7a598c