Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 20:25
Behavioral task
behavioral1
Sample
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
Resource
win10v2004-20240226-en
General
-
Target
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
-
Size
276KB
-
MD5
732aaa311c29f05aa811a89b4d0d1ac5
-
SHA1
a8b4098a8375feaf2d60cc2e8c89c38f21c8462a
-
SHA256
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3
-
SHA512
28f27280cf8da0d3f7f0904c6a0aab938ec464275d8cb92c71ac8646c9fea2ef3102d38256b32bb206ea6e11b793e50fe4030d1f92fc9c4d6fd023403602076d
-
SSDEEP
6144:VjluQoS3TpfT+xyFirBmVmjDlQCWqzqClW:VEQoS3Tp7+xyRYFQKzqj
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3092-12-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3372-141-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3428-182-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3092-185-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1620-189-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3372-191-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
Processes:
resource yara_rule behavioral2/memory/3428-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish nude lesbian uncut cock beautyfull .mpeg.exe UPX behavioral2/memory/3092-12-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1620-133-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3372-141-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3428-182-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3092-185-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1620-189-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3372-191-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/3428-0-0x0000000000400000-0x000000000041F000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish nude lesbian uncut cock beautyfull .mpeg.exe upx behavioral2/memory/3092-12-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1620-133-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3372-141-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3428-182-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3092-185-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1620-189-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3372-191-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File opened (read-only) \??\Q: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\S: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\A: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\E: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\H: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\I: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\J: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\O: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\V: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\G: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\T: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\U: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\B: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\L: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\M: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\N: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\P: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\R: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\Z: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\K: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\W: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\X: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File opened (read-only) \??\Y: 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Drops file in System32 directory 12 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File created C:\Windows\SysWOW64\FxsTmp\asian beast public YEâPSè& .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\IME\SHARED\swedish animal xxx big mistress (Anniston,Samantha).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\black horse xxx hot (!) hole ¤ç .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\beastiality hardcore licking hotel (Gina,Jade).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\config\systemprofile\american handjob xxx big titts bedroom .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\french trambling voyeur feet .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese porn xxx hidden glans (Sonja,Tatjana).mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\System32\DriverStore\Temp\brasilian gang bang trambling catfight glans ash .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\IME\SHARED\russian cum hardcore several models glans ¼ë .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\italian handjob beast hidden hole mistress (Jade).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\lesbian lesbian hole wifey .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\SysWOW64\FxsTmp\brasilian porn blowjob catfight (Liz).mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Drops file in Program Files directory 18 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\indian porn blowjob [milf] glans hairy .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\brasilian handjob bukkake uncut castration .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\bukkake uncut .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\swedish animal beast big ejaculation .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian beastiality lesbian big cock traffic (Sarah).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african gay big castration .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Google\Temp\bukkake catfight glans .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Google\Update\Download\swedish kicking gay lesbian 40+ .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\american animal blowjob lesbian glans femdom (Curtney).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\italian fetish fucking sleeping glans penetration (Sarah).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Microsoft\Temp\black nude hardcore hidden high heels .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\dotnet\shared\trambling licking granny .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Microsoft Office\root\Templates\fucking [bangbus] feet .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish nude lesbian uncut cock beautyfull .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\trambling public cock (Christine,Karin).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files\Microsoft Office\Updates\Download\swedish gang bang beast public .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\lesbian [free] traffic .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\fucking sleeping feet .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Drops file in Windows directory 64 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\british lesbian several models (Janette).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\kicking lingerie big .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\fucking [free] .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\fucking public titts lady (Melissa).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\lesbian [free] cock castration .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\lesbian lesbian .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\canadian horse several models .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\black kicking hardcore lesbian .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\british xxx voyeur feet .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\italian cum sperm girls black hairunshaved .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\hardcore [bangbus] .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\horse catfight balls .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\brasilian action horse sleeping balls (Christine,Curtney).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\beastiality hardcore girls cock (Jenna,Curtney).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\spanish beast voyeur boots (Jenna,Tatjana).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\spanish sperm hidden fishy .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\horse girls feet black hairunshaved (Melissa).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\handjob lingerie hidden titts girly .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\norwegian beast [free] (Samantha).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\russian nude xxx sleeping lady (Anniston,Sarah).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\african gay voyeur mistress .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\brasilian porn bukkake full movie (Janette).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\black cum bukkake full movie ejaculation .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\black cum bukkake [free] .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\canadian bukkake [free] girly .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\swedish handjob fucking public feet .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\canadian fucking masturbation blondie .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\russian nude horse [bangbus] glans ash .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\fucking catfight (Karin).zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\brasilian kicking gay several models glans wifey (Sarah).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\swedish action beast sleeping titts granny .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\horse lesbian big hole .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\chinese beast catfight glans .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\fucking licking .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\hardcore licking .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\italian fetish sperm hot (!) titts .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\porn lesbian girls .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\malaysia bukkake girls (Sylvia).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\african trambling big beautyfull .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\brasilian fetish beast [free] .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\american gang bang trambling public mature .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\beastiality trambling catfight .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\asian fucking sleeping penetration .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\american cumshot lingerie girls glans .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\hardcore masturbation bedroom .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\cum blowjob full movie beautyfull .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\malaysia blowjob public black hairunshaved .zip.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\lingerie [bangbus] feet femdom (Melissa).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\malaysia beast hidden .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\african fucking uncut hole shoes .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\CbsTemp\italian porn beast masturbation mature (Britney,Jade).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\italian nude trambling big blondie (Ashley,Janette).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\malaysia lesbian sleeping boots .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\indian cumshot blowjob [milf] upskirt .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\cumshot lesbian hidden feet .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\chinese bukkake public redhair (Sonja,Jade).mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\kicking sperm uncut penetration (Sonja,Curtney).avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\chinese blowjob girls young .avi.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\indian animal beast full movie hole swallow .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\swedish fetish lesbian uncut .mpg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\security\templates\horse uncut (Samantha).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\african trambling public hairy .mpeg.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\assembly\temp\tyrkish action bukkake girls pregnant (Sonja,Liz).rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\cum xxx hidden titts .rar.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exepid process 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3372 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 1620 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exedescription pid process target process PID 3428 wrote to memory of 3092 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3428 wrote to memory of 3092 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3428 wrote to memory of 3092 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3428 wrote to memory of 1620 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3428 wrote to memory of 1620 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3428 wrote to memory of 1620 3428 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3092 wrote to memory of 3372 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3092 wrote to memory of 3372 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe PID 3092 wrote to memory of 3372 3092 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe 415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"C:\Users\Admin\AppData\Local\Temp\415f7c1031863774a36012c2fe149b5d8d2fca9ceadf31a0ea792a285bfb49b3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\danish nude lesbian uncut cock beautyfull .mpeg.exe
Filesize668KB
MD56fd517781e891e85ad1667190bad4a3e
SHA1b425aa7a13dc515dab601088d4ee3ee378a26470
SHA256b2e35eae4705cd33c1d07d702b676d36481fe487ed059c890df57650897a80fa
SHA512dc610601738fba6649fba97972be4d4d56d7960be65c0652cb9f9e7cec8752479319c2eef9cf036e1ae11f799bd179048b9cb335e404fb1b8ad0f895f72a2c83