Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16/04/2024, 02:25
Behavioral task
behavioral1
Sample
d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe
Resource
win10v2004-20240412-en
General
-
Target
d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe
-
Size
1.9MB
-
MD5
6118821615938e49bb9f714ca248668d
-
SHA1
0117cd3f90406472c8d2d65e50cf77fd4e1741e4
-
SHA256
d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1
-
SHA512
1f22f6909c95d7fec03014357de82554286737cadfbdc12060234740f6bc9a61273c79c613dd473da5ff7e2c517c331590db21e11fc5e3915a5bebe71a12626e
-
SSDEEP
49152:d22WklVa2fFf/PSZuMtnDeBWRI7r3zHgIkM+K/elTmKbOx6R2yQj:HWAaIf/PuxeYRIfjhkM+KuiKbOx62yq
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 18 IoCs
resource yara_rule behavioral2/memory/1560-101-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-174-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1560-175-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2368-176-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3928-177-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-179-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-185-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-195-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-199-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-204-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-208-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-212-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-216-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-220-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-224-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-228-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-232-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3192-236-0x0000000000400000-0x000000000041D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/memory/3192-0-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/files/0x00080000000233f8-5.dat UPX behavioral2/memory/1560-101-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/2368-155-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-174-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/1560-175-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/2368-176-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3928-177-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-179-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-185-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-195-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-199-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-204-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-208-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-212-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-216-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-220-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-224-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-228-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-232-0x0000000000400000-0x000000000041D000-memory.dmp UPX behavioral2/memory/3192-236-0x0000000000400000-0x000000000041D000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3192-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/files/0x00080000000233f8-5.dat upx behavioral2/memory/1560-101-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2368-155-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-174-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/1560-175-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/2368-176-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3928-177-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-179-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-185-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-195-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-199-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-204-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-208-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-212-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-216-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-220-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-224-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-228-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-232-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/memory/3192-236-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\O: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\Q: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\X: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\I: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\L: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\P: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\V: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\Y: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\M: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\R: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\S: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\W: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\H: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\J: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\K: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\T: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\A: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\B: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\E: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\G: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\U: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File opened (read-only) \??\Z: d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\cumshot voyeur (Sarah,Sarah).avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beast voyeur .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\trambling action girls titts young .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\config\systemprofile\african hardcore beastiality hot (!) .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\FxsTmp\russian action nude big boobs .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\tyrkish handjob horse sleeping leather .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\config\systemprofile\french beast beast public vagina hotel .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\System32\DriverStore\Temp\japanese porn beastiality masturbation .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\IME\SHARED\african gay hidden 40+ (Jade).zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\xxx catfight titts high heels .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\IME\SHARED\russian horse uncut .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\black action girls feet (Sylvia).zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\tyrkish nude gay girls Ôï .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Google\Update\Download\british hardcore hardcore voyeur YEâPSè& .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\gang bang handjob big hairy .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian handjob public .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Common Files\microsoft shared\german cum lingerie [bangbus] .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american sperm horse [bangbus] .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\horse beastiality catfight .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\beastiality lesbian several models .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\gay voyeur (Anniston).rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\danish kicking hot (!) ejaculation .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Microsoft\Temp\EU8F3F.tmp\fetish porn girls leather (Samantha).mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\trambling public (Jenna).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files (x86)\Microsoft\Temp\japanese horse fetish [bangbus] lady .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\dotnet\shared\cumshot big legs swallow .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\beast blowjob [free] ejaculation .rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\nude licking .rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Microsoft Office\Updates\Download\swedish horse [free] nipples (Kathrin).rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Microsoft Office\root\Templates\black horse [free] hotel (Sylvia).zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beastiality full movie .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\american kicking uncut blondie .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\sperm xxx [milf] legs (Melissa,Christine).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\chinese action beastiality voyeur black hairunshaved (Christine,Jade).avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\Temp\asian trambling lingerie [bangbus] glans .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\japanese trambling hidden (Janette).avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\swedish horse trambling full movie hairy .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\african bukkake [bangbus] .rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\spanish nude cumshot several models cock young .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\canadian action [free] black hairunshaved .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\russian beast sleeping hole lady .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\horse several models YEâPSè& .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\black trambling licking shower (Jenna,Gina).rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.1_none_a80cea873b2a6772\american horse licking .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\spanish nude nude uncut .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\spanish bukkake hot (!) beautyfull (Sylvia).zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\trambling catfight penetration .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\blowjob cumshot big .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\spanish fucking [free] .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\lingerie several models swallow .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\Downloaded Program Files\japanese hardcore big vagina .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\security\templates\british blowjob hidden redhair (Sonja).rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\kicking gang bang catfight (Sylvia).avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\gang bang animal full movie legs (Tatjana).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\lingerie nude catfight .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\tyrkish action trambling uncut glans circumcision .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\beastiality lesbian (Curtney).mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\beastiality animal licking swallow (Sonja,Jenna).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\german beastiality uncut nipples stockings .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\lingerie sleeping young (Sonja).rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\danish porn sleeping glans .rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\lingerie hot (!) .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\norwegian fucking hot (!) nipples .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\porn cumshot licking boobs .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\german fucking horse big circumcision .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\african cumshot voyeur .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\tyrkish fetish catfight circumcision .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f8d34ba1b1eb00de\russian beast catfight granny .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\beastiality hardcore sleeping .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\sperm cum uncut cock beautyfull (Anniston,Jenna).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\spanish lesbian xxx big (Jenna,Janette).zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\brasilian sperm [bangbus] legs (Tatjana).zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\fucking hardcore [free] high heels .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\spanish cum hidden .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\action cum masturbation hole (Curtney,Liz).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\malaysia xxx animal [bangbus] .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\PLA\Templates\horse cum several models ejaculation .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\swedish kicking hidden .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_14c898cc82025c76\xxx gay sleeping legs .rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\gang bang beast [free] shower .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\tyrkish handjob action [free] glans redhair (Tatjana).mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\tyrkish action public (Kathrin,Britney).mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\black nude lesbian feet penetration (Sonja,Liz).mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\french horse handjob girls traffic .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\sperm [bangbus] upskirt .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\gay masturbation .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\german action several models .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\horse uncut (Britney).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\british handjob sleeping legs shower .mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\malaysia cum horse full movie boots .avi.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\horse [bangbus] stockings (Anniston).mpeg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\cum trambling hidden leather .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\british cumshot [milf] 50+ .zip.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\norwegian lesbian big ash .mpg.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\sperm voyeur titts (Karin).rar.exe d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 3928 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 2368 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3192 wrote to memory of 1560 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 91 PID 3192 wrote to memory of 1560 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 91 PID 3192 wrote to memory of 1560 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 91 PID 3192 wrote to memory of 2368 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 94 PID 3192 wrote to memory of 2368 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 94 PID 3192 wrote to memory of 2368 3192 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 94 PID 1560 wrote to memory of 3928 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 95 PID 1560 wrote to memory of 3928 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 95 PID 1560 wrote to memory of 3928 1560 d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928
-
-
-
C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"C:\Users\Admin\AppData\Local\Temp\d3c70aad6b05c8e6f4d78dcd3adc10973bba148980c1acd2b1252bf5c2d549b1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beastiality full movie .zip.exe
Filesize1.4MB
MD55a533465777e4bb12debf2e22c697ec7
SHA1a8bb9ff539df2822354dc0d130648afe72107766
SHA256928412bc7cedddff295f78c429ee20289a79d826e096c2029f774bf3454dd376
SHA5126998f074c82d48e46bf2429b3cbe4eb4bb1ba883504d0d87691fbf31731c4bb2c1823c40e9575e27c39e287addde58e5ec56163ea52ff6f69d8e0e6e601dfa14