aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-04-2024 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
Size

1.6MB
MD5

d8e96f46b4f280f00343c266cee210e6
SHA1

15a78c846a70cd85cf353900933c3c24bb629dbd
SHA256

aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29
SHA512

1cb63994a8843c46f3a81f5b6c601c0370b2be4a0a81c0326cdc2f22b4da259231b5e7d92c18cf9e8d23ec2e4db091d18f33d7337c6b069930f692ad4ac3c6c4
SSDEEP

24576:CIRV7utviSwHshP+bgXUNkfmQxUZcKt0uUIO57rZfuSi9kL37/fZkwUVC/1EdoZ5:1yRKGUNk+Qiu8UbrYSlL7hUc1KoeU

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 18 IoCs

resource	yara_rule
behavioral1/memory/2380-92-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-96-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2380-106-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-107-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-108-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-113-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-116-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-119-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-124-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-127-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-130-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-133-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-136-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-139-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-142-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-145-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2836-148-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 22 IoCs

resource	yara_rule
behavioral1/memory/2836-0-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/files/0x0007000000016c1f-5.dat	UPX
behavioral1/memory/2836-83-0x00000000046A0000-0x00000000046BF000-memory.dmp	UPX
behavioral1/memory/2200-84-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2380-92-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-96-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2380-106-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-107-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-108-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-113-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-116-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-119-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-124-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-127-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-130-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-133-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-136-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-139-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-142-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-145-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2836-148-0x0000000000400000-0x000000000041F000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2836-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x0007000000016c1f-5.dat	upx
behavioral1/memory/2836-83-0x00000000046A0000-0x00000000046BF000-memory.dmp	upx
behavioral1/memory/2200-84-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2380-92-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-96-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2380-106-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-107-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-108-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-113-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-116-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-119-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-124-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-127-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-130-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-133-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-136-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-139-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-142-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-145-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2836-148-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\Z:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\H:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\M:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\N:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\R:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\W:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\A:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\B:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\J:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\U:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\E:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\G:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\O:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\P:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\Q:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\V:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\Y:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\I:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\K:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\L:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\S:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File opened (read-only)	\??\T:	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\trambling blowjob [free] glans circumcision .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\SysWOW64\FxsTmp\japanese fucking fetish public feet (Ashley).avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\SysWOW64\config\systemprofile\bukkake full movie .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\SysWOW64\IME\shared\british cumshot [milf] shoes .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\japanese gang bang lesbian .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\SysWOW64\config\systemprofile\brasilian xxx cum several models granny .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\kicking action masturbation balls (Janette).mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\SysWOW64\FxsTmp\cum gang bang sleeping pregnant .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\SysWOW64\IME\shared\black hardcore [free] shoes .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\System32\DriverStore\Temp\tyrkish handjob girls (Jade).mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\chinese animal animal [milf] high heels (Sonja).rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\kicking big .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Google\Temp\malaysia beastiality horse big mistress (Curtney).mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\black lingerie animal hot (!) ash .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\hardcore horse several models .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\cumshot action [milf] circumcision .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\indian kicking public leather (Melissa,Jenna).mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\action public .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\danish gay action uncut feet (Samantha,Anniston).mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\nude girls .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\malaysia gang bang licking glans bondage .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files\Common Files\Microsoft Shared\italian horse hot (!) pregnant .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files\Windows Journal\Templates\horse [milf] legs blondie .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black kicking horse uncut cock .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Program Files (x86)\Google\Update\Download\chinese bukkake animal [milf] (Sarah).zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\brasilian horse catfight vagina stockings .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\trambling lesbian sleeping wifey (Jade).zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\german beastiality action full movie vagina femdom .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\swedish sperm cum [milf] sweet .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\swedish nude lesbian .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\asian blowjob gang bang hidden .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\action trambling public vagina .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\cum horse uncut high heels .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\french hardcore trambling several models nipples .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\blowjob full movie lady (Sonja,Tatjana).mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\lingerie hardcore catfight (Janette,Kathrin).mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\asian trambling full movie vagina .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\african sperm lesbian (Gina,Karin).mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm uncut ash penetration .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\canadian beast handjob uncut .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\american handjob cumshot several models (Sonja).rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\lesbian bukkake catfight granny (Curtney).mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\black hardcore sleeping (Kathrin).mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\swedish handjob nude hot (!) wifey (Curtney,Jade).zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\danish horse licking .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\danish nude xxx lesbian feet .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\sperm [free] boots .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\lesbian gang bang [bangbus] .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\cum [bangbus] young .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\american cumshot sperm several models bondage .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\canadian horse lesbian hot (!) hotel (Gina,Christine).mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\chinese fucking [milf] .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\PLA\Templates\lesbian cumshot [milf] legs femdom .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\brasilian gay handjob uncut .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\cum kicking catfight ash .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\norwegian porn [free] feet latex (Jade).zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\fucking beast several models gorgeoushorny (Ashley,Tatjana).avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\horse licking ash .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\lingerie hot (!) hotel (Christine,Curtney).rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\african gay nude catfight .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\swedish hardcore sleeping nipples upskirt .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\asian animal fetish [milf] ash 40+ (Britney).mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\japanese hardcore gang bang [bangbus] shower .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\canadian horse gang bang sleeping bedroom .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\african action fetish masturbation sm (Jenna,Gina).mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\norwegian bukkake [milf] hotel .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\kicking several models hairy (Jade).zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\swedish sperm [free] .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\danish trambling lesbian leather .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\mssrv.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\InstallTemp\canadian nude animal uncut glans swallow .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\animal horse voyeur .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\sperm cum uncut ash .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\lesbian catfight black hairunshaved .zip.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\italian horse hidden boobs traffic (Anniston,Britney).rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\cum girls girly .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\gang bang action girls (Karin,Curtney).mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\assembly\tmp\beast girls latex .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\french hardcore lesbian hole high heels .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\german trambling fucking licking balls .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\horse voyeur mature .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\asian lesbian lesbian ash 50+ .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\nude lesbian .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\danish sperm full movie hole 50+ .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\cum [bangbus] YEâPSè& .mpg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\action lesbian traffic .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse blowjob [free] granny .rar.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\french beast [bangbus] mistress .avi.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\american fetish public wifey .mpeg.exe	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2380	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2200	2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	28
PID 2836 wrote to memory of 2200	2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	28
PID 2836 wrote to memory of 2200	2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	28
PID 2836 wrote to memory of 2200	2836	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	28
PID 2200 wrote to memory of 2380	2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	29
PID 2200 wrote to memory of 2380	2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	29
PID 2200 wrote to memory of 2380	2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	29
PID 2200 wrote to memory of 2380	2200	aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe	29

C:\Users\Admin\AppData\Local\Temp\aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
"C:\Users\Admin\AppData\Local\Temp\aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
  "C:\Users\Admin\AppData\Local\Temp\aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe
    "C:\Users\Admin\AppData\Local\Temp\aab53b15c41daf89f4728bcf2e17a6cb988d20ca06733639c6cc98a7f1ecdd29.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\kicking big .mpg.exe

Filesize
372KB

MD5
36057af363bafa52c06e1a653701e0e3

SHA1
7d8896ff87a267d038cc024e0cf1447a5dea6808

SHA256
367013a54a0d92a80983ff7a274ac90db74cd303dec063e6ef8417f0412946ab

SHA512
9b7798e6b29e5cf484e9d9da7a67fdfa300174f860c8d4a5f2263321080ef97bcfdf55e3cfe1a61a9f1ec48e67498dcbab5b0bb334b4ec90c5676969331c5bde

Download Submit
C:\debug.txt

Filesize
183B

MD5
1637806da03c182b580f57dd3a5382b9

SHA1
5fd6b63725b77cfdd616da31c64d904ccb26aadc

SHA256
7a26228ec65586ef38e1c88609002ecc5ce95d05b5c7ad43ac4f0c85d2bb8513

SHA512
92a8b50f931f302655b0562fec5dd250d675117b730361660080a7d2c0072901ddf694539713ed85c538ef40d54b7386a3c2e1f68cdf364eb917f9f370a33858

Download Submit
memory/2200-105-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2200-112-0x0000000004580000-0x000000000459F000-memory.dmp

Filesize
124KB

Download
memory/2200-84-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2200-91-0x0000000004580000-0x000000000459F000-memory.dmp

Filesize
124KB

Download
memory/2380-92-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2380-106-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-110-0x00000000046A0000-0x00000000046BF000-memory.dmp

Filesize
124KB

Download
memory/2836-124-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-107-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-108-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-83-0x00000000046A0000-0x00000000046BF000-memory.dmp

Filesize
124KB

Download
memory/2836-113-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-116-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-119-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-96-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-127-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-130-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-133-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-142-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-145-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2836-148-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download