10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
Size

126KB
MD5

3812a9cda64039b9095e5805861e68d0
SHA1

ebe050574c3ebfa140b9d7c3c0048d2036b8ce2d
SHA256

10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42
SHA512

d66fddd464fef3219ac0951320053dd600d772b65a6aef4d47d25676eeddd0756a3c0935dacbdd89133227ee38ad8046ae1f859b6d49579928b04e4ac4a0e9df
SSDEEP

3072:VjbLl/gvQoutv4DQ1Tj4mYWR/R4nkPR/1aVuydlaW7HBVJoxdAN0JjpTZK:VjluQoSv4DSIo5R4nM/40ydlaW7lsto

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 18 IoCs

resource	yara_rule
behavioral1/memory/2500-77-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/280-87-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-91-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2500-100-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/280-101-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-102-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-107-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-110-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-113-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-118-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-121-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-124-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-127-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-130-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-133-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-136-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-139-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-142-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 20 IoCs

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/files/0x0007000000016a28-5.dat	UPX
behavioral1/memory/2500-77-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/280-87-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-91-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2500-100-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/280-101-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-102-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-107-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-110-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-113-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-118-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-121-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-124-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-127-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-130-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-133-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-136-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-139-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3032-142-0x0000000000400000-0x000000000041E000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0007000000016a28-5.dat	upx
behavioral1/memory/2500-77-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/280-87-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2500-100-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/280-101-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-102-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-107-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-110-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-113-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-118-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-121-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-124-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-127-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-130-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-133-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-136-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-139-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3032-142-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\O:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\S:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\W:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\Y:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\K:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\Q:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\U:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\B:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\E:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\I:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\J:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\P:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\V:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\X:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\A:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\G:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\H:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\M:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\N:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\R:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\T:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File opened (read-only)	\??\Z:	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FxsTmp\horse masturbation glans (Kathrin,Tatjana).avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SysWOW64\IME\shared\hardcore masturbation glans ash .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian cum fucking sleeping (Tatjana).zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\System32\DriverStore\Temp\trambling full movie ejaculation .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SysWOW64\FxsTmp\danish action beast lesbian wifey .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SysWOW64\config\systemprofile\swedish porn trambling full movie femdom .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\danish cumshot lingerie sleeping shower .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SysWOW64\config\systemprofile\norwegian trambling several models ejaculation .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SysWOW64\IME\shared\beast several models titts .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\beast public stockings (Jenna,Karin).rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\tyrkish kicking blowjob several models glans stockings (Karin).zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\american handjob gay girls mistress .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\italian cumshot sperm voyeur .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\brasilian gang bang sperm full movie upskirt .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files\DVD Maker\Shared\malaysia fucking girls cock .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files\Windows Journal\Templates\american animal lesbian masturbation .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian kicking gay lesbian bedroom .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Google\Update\Download\swedish nude gay masturbation feet .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\lesbian [bangbus] hole upskirt (Karin).zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian horse bukkake masturbation .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files\Common Files\Microsoft Shared\hardcore licking hole ìï .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\japanese fetish blowjob full movie titts lady (Sarah).mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\beast masturbation hotel .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Google\Temp\bukkake licking upskirt .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\american nude beast uncut stockings .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\gay several models .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\blowjob masturbation .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\porn beast hidden cock penetration (Sarah).rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\cumshot bukkake uncut feet high heels .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\tyrkish horse hardcore girls titts (Kathrin,Liz).avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\asian sperm big boots .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\brasilian cumshot trambling lesbian ash .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\tyrkish porn sperm licking hotel .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\african lesbian [free] hole (Sonja,Jade).mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\african gay big .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\french trambling [bangbus] stockings .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\french lesbian licking glans .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\porn sperm full movie hole .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\SoftwareDistribution\Download\american beastiality lingerie voyeur titts ìï (Curtney).rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\sperm uncut titts 40+ .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\horse lesbian big pregnant .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\security\templates\sperm several models leather .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian animal blowjob several models bondage (Gina,Janette).mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\spanish fucking licking glans .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\italian horse beast [bangbus] titts lady .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\swedish animal gay [free] feet leather (Liz).mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\asian fucking hot (!) cock swallow (Liz).zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\horse horse [bangbus] traffic .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\beast girls glans lady (Karin).mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\spanish bukkake [free] lady (Jenna,Karin).rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\russian porn lesbian [free] feet .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\PLA\Templates\tyrkish gang bang lingerie hot (!) titts castration .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\animal horse masturbation feet shoes (Melissa).mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\porn horse girls .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\asian fucking sleeping .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\spanish sperm masturbation granny .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\fetish lingerie big titts bondage (Samantha).mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\norwegian xxx uncut mature .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\british trambling [free] titts .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\japanese handjob xxx big (Sarah).avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\beast [free] fishy .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\spanish horse hot (!) latex .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\mssrv.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\lingerie uncut titts sweet .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\canadian fucking voyeur .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\bukkake catfight young (Sandy,Sarah).zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\blowjob hidden hole YEâPSè& .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\tyrkish fetish horse voyeur titts .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\russian action trambling catfight (Tatjana).mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian horse lingerie lesbian blondie .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\Downloaded Program Files\lesbian lesbian castration .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\animal lingerie big titts .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\cumshot bukkake licking bedroom .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\russian cum lesbian masturbation gorgeoushorny .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\horse full movie (Sarah).avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black fetish bukkake [milf] penetration .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\tyrkish fetish gay [bangbus] latex .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\danish kicking xxx catfight titts (Sonja,Curtney).zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\horse gay uncut hole granny .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\chinese fucking [free] titts shower .avi.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\swedish nude xxx uncut titts .mpeg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\russian action sperm big shower .mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\brasilian fetish sperm [free] .zip.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\norwegian sperm public hole shoes (Janette).mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\swedish gang bang fucking voyeur glans sweet (Samantha).mpg.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\german sperm full movie glans stockings (Samantha).rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\cumshot lingerie lesbian feet high heels .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\norwegian beast hidden titts boots .rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\lesbian [free] feet (Jenna,Samantha).rar.exe	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
280	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2500	3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	28
PID 3032 wrote to memory of 2500	3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	28
PID 3032 wrote to memory of 2500	3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	28
PID 3032 wrote to memory of 2500	3032	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	28
PID 2500 wrote to memory of 280	2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	29
PID 2500 wrote to memory of 280	2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	29
PID 2500 wrote to memory of 280	2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	29
PID 2500 wrote to memory of 280	2500	10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe	29

C:\Users\Admin\AppData\Local\Temp\10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
"C:\Users\Admin\AppData\Local\Temp\10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
  "C:\Users\Admin\AppData\Local\Temp\10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe
    "C:\Users\Admin\AppData\Local\Temp\10bef2995f79d2d2c372db16bec8188cab343df8528c0f00eb59ff65ff20bc42.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian kicking gay lesbian bedroom .zip.exe

Filesize
627KB

MD5
bcb4eebe0e111698ebc0be1fd9cfc93c

SHA1
5f2169278e062586462e5340a9899086d1c747ef

SHA256
1afc0aca41fda1a6ffaf12961b4b1c86e4353308a60c52c9a853f0a5ad9d2d3f

SHA512
fe3c3107654785a5b409aa0ab303a4c31e6803c2a90f499d803a1660bfa263f8c00dcb77a6ff3c52228da39bf63f7afd48f8c8858d0a6ba556108aee624c922e

Download Submit
C:\debug.txt

Filesize
183B

MD5
03de1e87fb9eedf64d14e2dcc4ef4161

SHA1
37b941c436cff8037d295bc59e25a5b9fa68042b

SHA256
ec94103e37b993e751557316dda96b5b48a919fea1211e2e0dd9ccbf07be1d11

SHA512
39c0872cecd7f15f13fb69d3700b6bba3b7c7f36aef2bff461681d46885efae9543e94e4af6ac0f077d01b551b93973d99fd16f59236a8e09fdad4b695909d24

Download Submit
memory/280-87-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/280-101-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2500-100-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2500-106-0x00000000007C0000-0x00000000007DE000-memory.dmp

Filesize
120KB

Download
memory/2500-77-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2500-86-0x00000000007C0000-0x00000000007DE000-memory.dmp

Filesize
120KB

Download
memory/3032-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-121-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-102-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-105-0x00000000059C0000-0x00000000059DE000-memory.dmp

Filesize
120KB

Download
memory/3032-76-0x00000000059C0000-0x00000000059DE000-memory.dmp

Filesize
120KB

Download
memory/3032-107-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-110-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-113-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-118-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-124-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-127-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-130-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-133-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-136-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3032-142-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download