Analysis
-
max time kernel
159s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-04-2024 20:05
Behavioral task
behavioral1
Sample
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe
Resource
win10v2004-20240226-en
General
-
Target
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe
-
Size
128KB
-
MD5
8b48fbf5dcefba2a141f43e595111bf7
-
SHA1
b857b81adb0e77fc40cbc5c2987e4909b211b1bc
-
SHA256
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757
-
SHA512
c95dbcdc560450690e8630d2215f420377c2bdd38b42a86e205c3b31038eb1bdfd955d22d49d60224f8da9979072bc190dfa4540a2a45f29345367bcf757a1c5
-
SSDEEP
3072:Dvs4dDXEGCLElz1Tj4mYWR/R4nkPR/1aVowVunF58s+vt:bPDLCL4Io5R4nM/4rVmbh+vt
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 1 IoCs
Processes:
resource yara_rule C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\malaysia horse hot (!) leather (Anniston).avi.exe UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x000000000041D000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\malaysia horse hot (!) leather (Anniston).avi.exe upx behavioral2/memory/4316-10-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2608-17-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1684-18-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/5004-106-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/4316-168-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2608-180-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1684-181-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exedescription ioc process File opened (read-only) \??\A: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\B: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\K: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\S: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\T: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\E: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\G: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\I: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\J: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\P: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\Z: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\H: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\Q: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\Y: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\V: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\W: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\L: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\M: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\N: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\O: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\R: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\U: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File opened (read-only) \??\X: 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe -
Drops file in System32 directory 12 IoCs
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exedescription ioc process File created C:\Windows\SysWOW64\IME\SHARED\bukkake bukkake voyeur .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\config\systemprofile\danish beastiality animal girls gorgeoushorny .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\italian lingerie action lesbian .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\gang bang cumshot several models leather .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\canadian sperm action lesbian lady (Sarah,Melissa).rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\nude [bangbus] .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\FxsTmp\gang bang big .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\IME\SHARED\chinese fucking blowjob uncut fishy .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\config\systemprofile\cumshot lingerie public .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\System32\DriverStore\Temp\brasilian beastiality blowjob voyeur .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SysWOW64\FxsTmp\hardcore cum full movie titts YEâPSè& .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beastiality licking (Tatjana).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe -
Drops file in Program Files directory 17 IoCs
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exedescription ioc process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\swedish sperm hot (!) .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Microsoft Office\Updates\Download\lingerie bukkake voyeur stockings .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\french kicking hidden (Ashley).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\animal [free] balls .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\american lingerie catfight .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\hardcore [bangbus] circumcision .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\american hardcore cum public .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\dotnet\shared\african hardcore kicking lesbian .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Microsoft Office\root\Templates\indian horse handjob masturbation .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\canadian fetish uncut cock femdom (Christine,Sarah).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\french porn porn [milf] 50+ (Jenna).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\cum trambling [bangbus] shoes .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files (x86)\Google\Temp\french fucking hot (!) .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files (x86)\Google\Update\Download\nude handjob hot (!) cock (Sonja,Sonja).zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Common Files\microsoft shared\norwegian porn girls .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\malaysia horse hot (!) leather (Anniston).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\swedish lesbian gang bang sleeping titts redhair (Sandy).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe -
Drops file in Windows directory 64 IoCs
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exedescription ioc process File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\malaysia lingerie lesbian public cock young .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\nude gang bang hidden pregnant .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\norwegian horse [bangbus] 40+ .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\sperm gang bang licking feet pregnant .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\kicking kicking sleeping feet penetration .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\horse voyeur (Ashley).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\brasilian porn beastiality lesbian nipples granny .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\british gang bang beastiality [milf] (Anniston).mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\beast bukkake [free] .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\russian blowjob beast catfight lady .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\norwegian animal lesbian pregnant (Samantha).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\chinese hardcore porn catfight latex (Jade).mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\american beastiality hardcore licking girly .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\italian nude hot (!) glans .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\lingerie bukkake hidden legs gorgeoushorny (Tatjana,Gina).rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_7d9dab4e456449b1\tyrkish gay cumshot [milf] (Jenna).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\xxx full movie feet Ôï .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\asian kicking voyeur girly (Karin).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\canadian cum uncut .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\brasilian nude girls mistress (Melissa).rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\japanese gang bang sleeping cock YEâPSè& .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\fucking uncut swallow .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\bukkake gay several models latex .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\beast hardcore hot (!) .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\horse public girly .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\gang bang several models latex (Curtney,Samantha).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\swedish trambling gang bang uncut (Tatjana,Samantha).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\asian animal several models ash latex .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\cum beastiality [free] (Anniston,Karin).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\horse fucking girls upskirt .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\brasilian action public .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\chinese blowjob porn sleeping .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\chinese bukkake gang bang catfight (Sarah,Ashley).rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\lesbian lesbian titts .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\chinese animal kicking public .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\african bukkake handjob girls mistress .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\german handjob hidden glans (Sylvia).rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\fucking horse hot (!) upskirt .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\swedish hardcore voyeur .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\kicking girls (Anniston).zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\bukkake catfight ash (Jenna,Sandy).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\british gay porn voyeur fishy .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\japanese kicking gay voyeur .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\african kicking handjob hidden shower .avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\action blowjob sleeping .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\action lesbian [milf] .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\brasilian cumshot several models nipples young .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\black cum handjob [free] titts granny .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\horse big black hairunshaved (Curtney,Christine).avi.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\tyrkish fucking fetish full movie nipples circumcision .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\russian xxx full movie traffic .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\american horse lingerie public YEâPSè& .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\porn beastiality [bangbus] vagina upskirt .mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\sperm horse uncut hole (Liz,Kathrin).rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\canadian fucking horse big .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\brasilian sperm cum [bangbus] titts lady .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\indian handjob bukkake catfight nipples (Britney).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\security\templates\black lingerie horse [milf] hairy .rar.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\british beastiality lesbian full movie granny (Melissa).mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\lingerie big .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\InstallTemp\fucking trambling full movie hole .mpg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\french kicking lesbian big vagina fishy .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\japanese horse sleeping vagina shower .zip.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe File created C:\Windows\InputMethod\SHARED\animal big boobs (Anniston,Gina).mpeg.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exepid process 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 1684 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 2608 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exedescription pid process target process PID 5004 wrote to memory of 4316 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 5004 wrote to memory of 4316 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 5004 wrote to memory of 4316 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 4316 wrote to memory of 2608 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 4316 wrote to memory of 2608 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 4316 wrote to memory of 2608 4316 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 5004 wrote to memory of 1684 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 5004 wrote to memory of 1684 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe PID 5004 wrote to memory of 1684 5004 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe 3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"C:\Users\Admin\AppData\Local\Temp\3785c48f0d4ca3ac00bf9fa651e3dba57198b8591e7d2267d77c6138dc2a1757.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\malaysia horse hot (!) leather (Anniston).avi.exe
Filesize2.0MB
MD5f1cbaa8aec71c748e57a9e1ccb110e0f
SHA14371db57e321a0c969993df86d6b5af1d770cc9a
SHA256e416ebe36e0785b833adbaae6dd55bfe61be3437986f426e3d8a863f4de994c0
SHA512ac6940a3aba60e42295d87ad2549c03ee771ff557084b08ef9c9e9ab9808b482b27dd0f9f3c09f07f3ffe30524bfa9eafcc8f16c6b5b95873c61d95d74a3d3da