Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 20:28
Behavioral task
behavioral1
Sample
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe
Resource
win10v2004-20231215-en
General
-
Target
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe
-
Size
1.2MB
-
MD5
7a4608c4e9db0dd47d25f51fff8dc5c1
-
SHA1
ee61193ec34d5d1c947048a0b4f9e29547418a52
-
SHA256
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4
-
SHA512
9d90a901ec9945d20b49cc7f0df3e21fed6eba1c81c9743d49f1b55a03ad2790862c14672a1b66d6a78d5c89bdc6df45e2ca6b26aa242781c6ab1ef1f27016e8
-
SSDEEP
24576:A8NNrAaKug59gR1bFU5HDBZiOhDBD279xnMw99qFy8EjwOoQpQIfCeT9J+k:ACrbrge1bFuBZnq79dMr9yJYeTV
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
Processes:
resource yara_rule behavioral2/memory/1756-163-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3276-167-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-183-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4068-184-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1756-185-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-188-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-189-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-195-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-205-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-209-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-214-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-218-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-222-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-226-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-230-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-234-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-238-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-242-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2280-246-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
Processes:
resource yara_rule behavioral2/memory/2280-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\african fucking trambling girls 40+ (Samantha).mpeg.exe UPX behavioral2/memory/1756-163-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/3276-167-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-183-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/4068-184-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/1756-185-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-188-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-189-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-195-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-205-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-209-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-214-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-218-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-222-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-226-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-230-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-234-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-238-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-242-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral2/memory/2280-246-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2280-0-0x0000000000400000-0x000000000041C000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\african fucking trambling girls 40+ (Samantha).mpeg.exe upx behavioral2/memory/1756-163-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3276-167-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-183-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4068-184-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1756-185-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-188-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-189-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-195-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-205-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-209-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-214-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-218-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-222-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-226-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-230-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-234-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-238-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-242-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2280-246-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exedescription ioc process File opened (read-only) \??\W: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\X: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\I: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\O: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\Q: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\S: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\P: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\G: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\H: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\L: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\M: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\U: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\A: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\B: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\K: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\N: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\V: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\Y: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\Z: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\E: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\J: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\R: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File opened (read-only) \??\T: 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe -
Drops file in System32 directory 12 IoCs
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exedescription ioc process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\trambling beast [bangbus] swallow (Kathrin).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\config\systemprofile\animal action [free] shoes .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\System32\DriverStore\Temp\trambling beastiality girls (Sonja,Sandy).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\action fucking girls boots (Jade).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\beastiality hot (!) sm (Anniston).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\config\systemprofile\fetish catfight pregnant .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\tyrkish sperm lingerie girls girly .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\FxsTmp\danish lingerie lesbian girls balls .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\IME\SHARED\hardcore gay catfight lady .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\french gay full movie .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\FxsTmp\lesbian kicking girls shower (Anniston).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SysWOW64\IME\SHARED\russian gang bang lesbian 40+ .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe -
Drops file in Program Files directory 18 IoCs
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\lesbian several models .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\dotnet\shared\spanish cumshot blowjob licking gorgeoushorny .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\spanish bukkake uncut .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Google\Update\Download\malaysia horse [free] bedroom (Sylvia,Kathrin).zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\norwegian action catfight vagina (Jenna).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\japanese trambling gay [milf] .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\african fucking trambling girls 40+ (Samantha).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\hardcore fetish masturbation hole .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\Microsoft Office\Updates\Download\norwegian kicking [milf] 40+ .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Microsoft\Temp\british sperm bukkake catfight boots .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fetish cum catfight penetration (Jenna).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian blowjob gang bang sleeping penetration (Anniston,Liz).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\swedish fucking public ΋ (Liz,Sonja).avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\chinese sperm beastiality big .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Google\Temp\cum uncut glans shower .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files\Microsoft Office\root\Templates\danish beast catfight nipples .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\french beastiality hidden titts fishy (Janette).avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\porn cum hot (!) shoes (Curtney).avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe -
Drops file in Windows directory 64 IoCs
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\gay hardcore lesbian .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\russian cum lingerie public 50+ .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\action fucking several models (Sylvia).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\african cumshot animal public young (Curtney,Christine).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\russian kicking porn several models vagina .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\american fucking girls leather (Melissa).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\japanese gang bang gang bang full movie boots .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\hardcore catfight lady .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\fucking sperm licking upskirt (Christine).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\chinese horse beastiality masturbation boobs mistress .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\japanese lesbian [free] nipples .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\british porn girls .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\norwegian lingerie beast hot (!) glans penetration .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\animal catfight penetration .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese blowjob masturbation .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\japanese lesbian hot (!) hole mature (Anniston,Jenna).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\chinese horse handjob full movie legs .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\asian sperm hidden titts .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\horse uncut bedroom .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\brasilian porn xxx uncut hole .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\kicking masturbation wifey (Gina,Gina).avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\british lingerie trambling sleeping femdom .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\russian nude fetish hot (!) ash .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\italian gay nude [free] glans high heels .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\gay blowjob lesbian castration (Sonja).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\british horse masturbation .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\japanese beast uncut (Sandy).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\spanish xxx hardcore masturbation hole .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\norwegian horse animal girls (Britney,Sarah).avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\black gang bang cumshot [milf] boobs ash .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\sperm horse sleeping glans lady .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\brasilian horse blowjob licking shoes .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\blowjob fucking uncut shower (Sonja,Sarah).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\lesbian licking ash shower .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\assembly\temp\african action handjob masturbation boobs .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\indian cum porn hidden hairy (Sonja).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\indian beastiality sperm full movie swallow .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\porn cum hot (!) young (Jenna,Janette).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\italian fetish several models (Sandy).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\sperm fetish [milf] gorgeoushorny .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\british beast cumshot [bangbus] .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\asian lingerie sperm [free] penetration .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\xxx several models .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\trambling public titts Ôï .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\InputMethod\SHARED\malaysia beastiality cum big .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\italian beastiality lesbian feet pregnant .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\danish xxx lesbian big femdom .avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\spanish gang bang handjob [free] ash .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\lingerie full movie (Curtney,Jenna).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\fetish fucking girls .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\animal [bangbus] high heels .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\indian hardcore nude lesbian YEâPSè& (Gina,Gina).rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\brasilian animal cumshot sleeping .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\cumshot [milf] vagina (Curtney,Gina).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\gang bang gay hot (!) ash penetration .mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\fetish cumshot [milf] nipples beautyfull (Ashley,Jade).avi.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\fetish big .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\swedish gang bang fucking catfight nipples sm .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\french bukkake masturbation ejaculation .mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\tyrkish lingerie hot (!) cock .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\beast voyeur traffic .zip.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\chinese lingerie animal sleeping girly (Jenna,Kathrin).mpg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\african gay full movie feet .rar.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\fetish cumshot full movie swallow (Tatjana,Kathrin).mpeg.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exepid process 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 3276 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 1756 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exedescription pid process target process PID 2280 wrote to memory of 4068 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 2280 wrote to memory of 4068 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 2280 wrote to memory of 4068 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 2280 wrote to memory of 1756 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 2280 wrote to memory of 1756 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 2280 wrote to memory of 1756 2280 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 4068 wrote to memory of 3276 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 4068 wrote to memory of 3276 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe PID 4068 wrote to memory of 3276 4068 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe 426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3276
-
-
-
C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"C:\Users\Admin\AppData\Local\Temp\426926d985d5b22b2916d8344257108460d5a83672f3bbecd3b55c5877496ee4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\african fucking trambling girls 40+ (Samantha).mpeg.exe
Filesize793KB
MD592dfba0c112e45df1ce9c2678249337f
SHA1aee3e67e63278ee5f65db861c170cfe0e614a1e8
SHA2563a776e9b4edd824b12a67a19db8cfeb5d9dbb505a0ecee447da12f2c28f9c2de
SHA512e9df68870488e528b95722469fa5486463d247c5cf752d76f5081ca9dcd288170f9c76ad6a0f3135a4352895e640e2fee62633714439531d24d5b731afccc830