Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 20:10
Static task
static1
Behavioral task
behavioral1
Sample
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe
Resource
win10v2004-20240226-en
General
-
Target
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe
-
Size
248KB
-
MD5
1753e870c7555e5a183036511a9625ba
-
SHA1
0f79bfbc5a06dda56bf5311e51e9b7f5e8b05793
-
SHA256
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126
-
SHA512
7fb5731542d58d73eec81aa1719107bdb3bf96a0f36c023b65edcfa01ccb717e05b714ff5bea03fed54759010129a71d2e380fad716ce0ff360d2444a7e06103
-
SSDEEP
6144:aDOxZXrSHXUTsqQ33gjWHGP9a5yaZDAUaPT2:lXa8sqUgjlNaZDFYT2
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 18 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-85-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2532-86-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2404-87-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-88-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-89-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-94-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-107-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-110-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-113-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-116-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-119-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-124-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-127-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-130-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-133-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-136-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-139-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2024-142-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX C:\Program Files\Windows Sidebar\Shared Gadgets\horse several models glans .rar.exe UPX behavioral1/memory/2532-16-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-85-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2532-86-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2404-87-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-88-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-89-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-94-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-107-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-110-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-113-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-116-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-119-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-124-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-127-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-130-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-133-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-136-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-139-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2024-142-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exedescription ioc process File opened (read-only) \??\Y: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\E: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\G: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\N: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\U: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\V: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\Z: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\B: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\I: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\O: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\Q: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\X: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\S: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\A: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\H: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\J: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\K: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\M: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\L: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\P: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\R: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\T: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File opened (read-only) \??\W: 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe -
Drops file in System32 directory 10 IoCs
Processes:
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\black porn blowjob several models pregnant .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\SysWOW64\IME\shared\sperm sleeping boots (Anniston,Liz).avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\fucking sleeping (Janette).rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\SysWOW64\IME\shared\trambling [bangbus] cock young .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian fetish bukkake [bangbus] leather .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\System32\DriverStore\Temp\italian beastiality horse hot (!) sm .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\SysWOW64\FxsTmp\danish cumshot fucking voyeur gorgeoushorny (Ashley,Curtney).mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\SysWOW64\config\systemprofile\tyrkish horse bukkake big shoes (Jenna,Sylvia).mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian beastiality trambling several models hole femdom .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\SysWOW64\FxsTmp\trambling hot (!) glans black hairunshaved .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe -
Drops file in Program Files directory 15 IoCs
Processes:
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exedescription ioc process File created C:\Program Files (x86)\Google\Temp\horse public .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian cum blowjob hidden .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files\Windows Journal\Templates\fucking masturbation feet fishy .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\horse several models glans .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\lingerie [free] .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files\Common Files\Microsoft Shared\black nude sperm hidden bedroom .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Common Files\microsoft shared\bukkake girls hole pregnant .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\sperm [free] bondage .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Microsoft Office\Templates\japanese beastiality horse [milf] feet .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\indian fetish bukkake [bangbus] stockings .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files\DVD Maker\Shared\indian cumshot lesbian full movie cock sm .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\japanese gang bang fucking [milf] girly .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian horse beast public YEâPSè& .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Google\Update\Download\danish cumshot trambling lesbian cock mature .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\japanese horse xxx big glans latex .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe -
Drops file in Windows directory 64 IoCs
Processes:
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exedescription ioc process File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\spanish hardcore hidden castration .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\russian nude hardcore girls castration (Gina,Liz).mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\handjob fucking sleeping redhair .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\spanish gay big .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\tyrkish beastiality beast hidden feet .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\norwegian lingerie sleeping blondie (Anniston,Tatjana).rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\blowjob [free] hairy .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\hardcore several models .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\gay hot (!) (Melissa).zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\porn sperm full movie feet sm .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\porn bukkake catfight blondie (Sonja,Karin).mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\Temp\russian cum horse [free] titts hairy .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\black cum xxx licking ejaculation .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\african lingerie big 40+ (Gina,Curtney).avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\german bukkake hidden feet .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\black horse lingerie lesbian castration .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\african sperm hot (!) leather (Gina,Liz).avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\chinese trambling hot (!) balls .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\brasilian porn lingerie masturbation titts 40+ (Sarah).mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\tyrkish fetish horse hidden (Janette).avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\cumshot xxx [free] titts wifey (Curtney).zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\gang bang lesbian [free] .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\asian horse catfight boots .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\trambling lesbian hole YEâPSè& .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\norwegian xxx [free] titts 50+ (Melissa).rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\lingerie [free] hole high heels .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\canadian bukkake public titts .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\sperm girls titts .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\italian fetish bukkake lesbian cock (Sonja,Curtney).avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\japanese kicking beast uncut hairy (Sonja,Janette).zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\asian hardcore full movie (Liz).mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\horse xxx hot (!) blondie .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\russian cumshot bukkake masturbation .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\norwegian trambling big cock .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\indian gang bang trambling [milf] hole black hairunshaved .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\bukkake masturbation .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\russian animal lesbian public mistress .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\spanish fucking hidden feet swallow .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\spanish lesbian voyeur hole shoes (Jade).mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\horse full movie cock .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\canadian gay sleeping redhair .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\mssrv.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\tyrkish nude bukkake hidden hole castration .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\malaysia beast sleeping cock .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\InstallTemp\hardcore [bangbus] .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\japanese cum horse licking feet .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\british blowjob several models .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\tyrkish porn horse sleeping .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\lesbian catfight hole fishy .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\spanish trambling public .rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\asian gay voyeur hole mature (Curtney).mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\chinese sperm licking (Sarah).zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\beast hidden penetration .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\italian gang bang sperm hot (!) hairy .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\horse big hole shower (Karin).zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\trambling several models glans YEâPSè& .avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\beast girls titts black hairunshaved (Sylvia).rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\indian gang bang horse licking mistress .mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\american beastiality lingerie catfight bedroom .zip.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\danish fetish hardcore hidden sm (Sandy,Melissa).avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\fetish horse [bangbus] cock sm (Sylvia).avi.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\security\templates\russian action sperm [milf] glans mature (Jade).rar.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\japanese kicking sperm [bangbus] young .mpeg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\brasilian cumshot trambling hidden feet swallow (Jade).mpg.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exepid process 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 2404 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exedescription pid process target process PID 2024 wrote to memory of 2532 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe PID 2024 wrote to memory of 2532 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe PID 2024 wrote to memory of 2532 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe PID 2024 wrote to memory of 2532 2024 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe PID 2532 wrote to memory of 2404 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe PID 2532 wrote to memory of 2404 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe PID 2532 wrote to memory of 2404 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe PID 2532 wrote to memory of 2404 2532 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe 39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe"C:\Users\Admin\AppData\Local\Temp\39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe"C:\Users\Admin\AppData\Local\Temp\39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe"C:\Users\Admin\AppData\Local\Temp\39fea18ace0dd1bbb2c3be98d493cb9a55c43f9dd74ff0d34399a56a2f126126.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD59af1ad3c766240e23431618ba9fe8fc9
SHA13634f86893c67b43cec8ff15d078faa818f26364
SHA256a9cf128b0504ef703af393cba2da9d8a3e969efdf98dfd8f650fa6f995b18d29
SHA512349d9a5673f39d8f00b662e5ace610c3026010b3c4c180b27b191346453b660e1043f5a91248ca6f373b7d7cfa90a51b00510120d278aae02fa7e298a85ff3fd
-
Filesize
183B
MD5de501c17d1dec9cb05179b0dad85aa4d
SHA1809de62699955c9b1b20670c48ffbd5c4000188b
SHA25612ea4c177fa8e5f1ac3ac9d497949a47a43d0860c6af57085140b0e2b7ed63ba
SHA51224d712ecaf66102d6e76ee54e901130b7838614b48dad88ec418ba8d0b6180c1b33589273220af5c951df2187554bca755a7d351688c329e48153842356382ea