Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 01:20
Behavioral task
behavioral1
Sample
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe
Resource
win10v2004-20240226-en
General
-
Target
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe
-
Size
395KB
-
MD5
c80ff23194e04bab4f4745a8d7370f67
-
SHA1
fad8a0cc13cf3cb7dfef6b83afe9a257ca2e9588
-
SHA256
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac
-
SHA512
42ede1ed76c0de03b4c8481f0ac938490b4f2982982b5162c0c7c29b150ba5ed7f63094c3829ad8ee6af348f8d3d6a704e395e6dd4b6bd639bd16b4f09b5d8ed
-
SSDEEP
12288:JEyDMhqhDtvOS1aeC8arI2BYC+N6kJU5TGADxxLf1:JBD0S1akadYC+Uky5Tx3L9
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 18 IoCs
Processes:
resource yara_rule behavioral2/memory/1828-40-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-158-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4472-167-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1828-185-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1568-186-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-187-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-188-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-192-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-205-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-210-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-216-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-230-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-234-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-238-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-242-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-247-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-251-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1100-255-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
Processes:
resource yara_rule behavioral2/memory/1100-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x000b000000023133-5.dat UPX behavioral2/memory/4472-23-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1828-40-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-158-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4472-167-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1828-185-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1568-186-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-187-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-188-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-192-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-205-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-210-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-216-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-230-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-234-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-238-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-242-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-247-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-251-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1100-255-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exec771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1100-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x000b000000023133-5.dat upx behavioral2/memory/4472-23-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1828-40-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-158-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4472-167-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1828-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1568-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-192-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-205-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-210-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-216-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-230-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-234-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-238-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-242-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-247-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-251-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1100-255-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exedescription ioc Process File opened (read-only) \??\X: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\Z: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\J: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\M: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\P: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\U: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\W: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\A: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\B: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\E: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\O: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\Q: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\I: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\K: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\R: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\T: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\V: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\Y: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\G: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\H: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\L: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\N: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File opened (read-only) \??\S: c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe -
Drops file in System32 directory 12 IoCs
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exedescription ioc Process File created C:\Windows\SysWOW64\config\systemprofile\hardcore horse [milf] .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\System32\DriverStore\Temp\swedish gay blowjob several models sm (Sandy,Kathrin).avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\FxsTmp\xxx fetish girls (Samantha,Kathrin).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\porn kicking girls high heels .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\malaysia lesbian lesbian [free] hairy .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\FxsTmp\spanish gay handjob hidden (Samantha,Jade).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\IME\SHARED\horse horse sleeping (Karin,Sonja).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\bukkake public sweet .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\config\systemprofile\hardcore catfight (Britney).zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\IME\SHARED\horse several models feet gorgeoushorny .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\danish bukkake public .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\japanese porn kicking masturbation .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe -
Drops file in Program Files directory 18 IoCs
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exedescription ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\spanish gang bang full movie (Jade,Anniston).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian lesbian action [bangbus] shower .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\chinese gay bukkake hidden mistress .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\dotnet\shared\asian xxx catfight (Melissa,Kathrin).mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\Microsoft Office\Updates\Download\blowjob bukkake sleeping feet .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\danish gay sperm [free] (Jade).mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\swedish bukkake uncut mature .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\british animal cumshot [milf] high heels .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\Microsoft Office\root\Templates\african handjob beastiality sleeping boobs hotel .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\porn gang bang big ash .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\chinese gay gay lesbian .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\fetish handjob full movie ash fishy (Sonja,Karin).rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Google\Temp\horse lesbian catfight legs penetration .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Google\Update\Download\sperm trambling licking swallow .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\horse bukkake [milf] hole gorgeoushorny .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\Common Files\microsoft shared\porn lesbian boobs (Liz).avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\japanese gang bang big castration .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Program Files (x86)\Microsoft\Temp\american beastiality hardcore uncut black hairunshaved .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe -
Drops file in Windows directory 64 IoCs
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exedescription ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\indian gang bang hot (!) sweet .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\russian hardcore horse hot (!) boobs traffic (Liz,Sarah).mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\xxx fucking big pregnant .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\german nude licking Ôï (Sarah).avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\swedish sperm lingerie lesbian (Curtney).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\brasilian fucking action [free] pregnant .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\cum big glans .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\tyrkish action hardcore lesbian blondie (Sonja).zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\xxx licking .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\french animal several models ¼ë .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\fetish uncut .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\porn big balls .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\asian fucking hot (!) cock sweet (Liz,Kathrin).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_4756d423b091d10b\spanish fucking catfight cock shower .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\sperm cum voyeur ejaculation (Jenna,Sarah).zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bca64d70c79f104b\brasilian lingerie big titts black hairunshaved (Sandy).mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\japanese handjob girls ash blondie (Britney).rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\nude action [milf] lady (Sylvia).mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\bukkake trambling sleeping bedroom .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\spanish animal several models young .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\cum [bangbus] cock (Sandy).mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\malaysia blowjob xxx hot (!) YEâPSè& .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\brasilian sperm cumshot [bangbus] bondage .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\gang bang licking (Sonja,Ashley).avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\fucking lesbian shoes .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\bukkake lesbian stockings .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\italian animal [milf] black hairunshaved .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\danish porn blowjob full movie femdom .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\swedish handjob kicking several models .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\black blowjob gay public .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\gay sleeping .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\fucking action hidden .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\bukkake hardcore hot (!) .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\russian action full movie boots .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\norwegian handjob voyeur hole black hairunshaved .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\horse voyeur nipples (Liz).rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\fucking hidden ash leather .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.546_none_a93e4a2569276206\blowjob [free] stockings (Tatjana).avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\canadian gang bang lingerie lesbian glans .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\PLA\Templates\tyrkish cumshot several models .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\bukkake horse girls hairy .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\fucking uncut upskirt .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\american trambling fetish hot (!) .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\cumshot [free] .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\beastiality catfight cock 40+ (Tatjana,Melissa).rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\beast public pregnant .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\lesbian hidden feet .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\animal trambling uncut (Britney).rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\swedish lingerie full movie vagina .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\japanese xxx sperm several models 50+ (Curtney,Anniston).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\asian horse gang bang sleeping wifey .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\cum catfight hole beautyfull .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\malaysia bukkake licking fishy .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\action big feet (Ashley,Curtney).rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\kicking nude masturbation femdom (Melissa,Sylvia).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\asian gang bang full movie legs .rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\swedish beastiality fucking voyeur nipples leather .mpeg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.1_none_5a23b464e1e0b15e\brasilian porn catfight (Curtney).rar.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\kicking cumshot girls .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\danish hardcore hidden traffic .avi.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\Temp\russian gang bang action public .zip.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\indian beastiality lesbian catfight granny .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\horse licking feet high heels .mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\porn several models vagina YEâPSè& (Liz,Sarah).mpg.exe c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exec771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exec771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exec771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exepid Process 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1568 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 1828 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exec771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exedescription pid Process procid_target PID 1100 wrote to memory of 4472 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 88 PID 1100 wrote to memory of 4472 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 88 PID 1100 wrote to memory of 4472 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 88 PID 1100 wrote to memory of 1828 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 89 PID 1100 wrote to memory of 1828 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 89 PID 1100 wrote to memory of 1828 1100 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 89 PID 4472 wrote to memory of 1568 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 90 PID 4472 wrote to memory of 1568 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 90 PID 4472 wrote to memory of 1568 4472 c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568
-
-
-
C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"C:\Users\Admin\AppData\Local\Temp\c771f41c037acef1afa0d88479474f76c51fe61a1593807ea54c0c5a11af06ac.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\porn gang bang big ash .zip.exe
Filesize614KB
MD52e54ca0e6c106d637a69c43c27d6770e
SHA13450b98e4f3696436eed803778e8848b234f48d3
SHA256a585522be5c98f0870651fa9320761dbf8887ece9f09cf4c7d5d9343f161727f
SHA512a2d674cf0f382d451b5e25e067e4ab71841f278fd27ec282ca158e5f0a86fb07671b4e2b02e972986614fc42321fdb92882b33d0e1de57e4ccd370a8f5785c45