cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af

Analysis

max time kernel
162s
max time network
174s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-04-2024 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
Size

286KB
MD5

8344c17140c7b0d718722cfd1b44bd4d
SHA1

eb82e0164844d06899eafc0fb6c49b5c8aa5958a
SHA256

cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af
SHA512

99559f19368b75abe677941fbd2112642521cbeea90358566768598789c371a30937a309134fa030afd8ef888ffeef9b4718c2d3115b64fa4004db4e23f64972
SSDEEP

6144:CjluQoSIIo5RaqrF3h0PNrpil0hh0m+Aa9MmgNZR2T3miV:CEQoSs7SPNNI0hKmq9MmgfRPiV

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 19 IoCs

resource	yara_rule
behavioral1/memory/2544-20-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2924-64-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-68-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2544-69-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2924-81-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-95-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-96-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-101-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-104-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-107-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-110-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-114-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-117-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-120-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-125-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-136-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-139-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-142-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2504-145-0x0000000000400000-0x000000000041F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 21 IoCs

resource	yara_rule
behavioral1/memory/2504-0-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/files/0x0007000000016c13-5.dat	UPX
behavioral1/memory/2544-20-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2924-64-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-68-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2544-69-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2924-81-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-95-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-96-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-101-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-104-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-107-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-110-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-114-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-117-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-120-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-125-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-136-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-139-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-142-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral1/memory/2504-145-0x0000000000400000-0x000000000041F000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2504-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x0007000000016c13-5.dat	upx
behavioral1/memory/2544-20-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2924-64-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-68-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2544-69-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2924-81-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-95-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-96-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-101-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-104-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-107-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-110-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-114-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-117-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-120-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-125-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-136-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-139-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-142-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2504-145-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\A:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\B:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\Q:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\T:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\W:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\Y:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\H:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\I:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\J:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\M:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\P:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\S:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\G:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\L:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\R:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\U:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\E:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\K:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\N:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\O:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\V:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File opened (read-only)	\??\X:	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FxsTmp\danish beastiality bukkake lesbian feet .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SysWOW64\config\systemprofile\russian fetish xxx masturbation glans lady (Janette).zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian animal gay catfight cock .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\System32\DriverStore\Temp\gay big .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SysWOW64\FxsTmp\kicking blowjob [free] fishy .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SysWOW64\IME\shared\danish kicking gay hidden glans upskirt .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\xxx big sm .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SysWOW64\config\systemprofile\fucking hot (!) upskirt .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black gang bang xxx hot (!) glans shower .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SysWOW64\IME\shared\black beastiality gay voyeur .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Templates\american porn fucking masturbation titts wifey .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files\DVD Maker\Shared\swedish porn horse [bangbus] castration (Ashley,Karin).mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files\Windows Journal\Templates\sperm sleeping .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\lingerie hidden .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian action sperm voyeur .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\beast sleeping .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Google\Temp\horse voyeur (Janette).avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files\Common Files\Microsoft Shared\beast [milf] cock 50+ (Karin).mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Google\Update\Download\sperm several models .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian kicking blowjob uncut (Sarah).mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish cum lesbian girls cock ash (Samantha).mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\horse voyeur glans black hairunshaved (Liz).rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\danish handjob xxx public balls .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\horse masturbation castration .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\brasilian beastiality blowjob masturbation mature .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\fucking catfight feet beautyfull (Liz).avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\british horse [milf] mature .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\horse trambling [free] feet .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\african xxx uncut black hairunshaved .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\lesbian sleeping pregnant .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\lesbian catfight (Jade).zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\american animal fucking lesbian titts .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\horse girls boots .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\black cumshot gay [free] latex (Sonja,Jade).avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\fucking [free] cock .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\malaysia blowjob [free] hole blondie (Samantha).rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\chinese hardcore girls glans girly (Sylvia).avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\british hardcore girls glans .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\horse hot (!) boots (Sonja,Sarah).mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\animal hardcore hot (!) hole beautyfull .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\security\templates\beast several models glans .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\black handjob trambling catfight titts .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\russian cumshot xxx several models lady .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\canadian lesbian licking (Liz).mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\tyrkish cum blowjob public circumcision .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\asian gay girls sweet .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\indian fetish blowjob lesbian titts .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\american cum trambling hidden titts hotel .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\brasilian animal sperm full movie 50+ .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\hardcore licking mistress .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\malaysia lingerie hot (!) hole boots .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\trambling catfight feet shower .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\action xxx voyeur hole bondage .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\porn sperm uncut hole mature .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\InstallTemp\sperm big .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\malaysia horse public .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\french xxx full movie feet castration (Curtney).rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\black porn sperm hidden (Sarah).mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\beast lesbian gorgeoushorny .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\horse gay licking .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\hardcore full movie hotel .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\lingerie hidden YEâPSè& .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\trambling [milf] bedroom (Christine,Tatjana).rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\sperm catfight sweet .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\canadian beast hidden circumcision .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\danish porn gay public .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\cum horse big .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\Downloaded Program Files\black kicking hardcore [milf] cock (Sandy,Liz).mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\danish cumshot hardcore full movie castration .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\canadian hardcore masturbation .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\cumshot bukkake public .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\tyrkish handjob xxx masturbation hole black hairunshaved (Karin).avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\american horse gay lesbian cock femdom .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\chinese lingerie voyeur .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\spanish xxx sleeping .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\blowjob [milf] hotel .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\nude beast masturbation (Melissa).mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\action gay public .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\lesbian hot (!) titts .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\hardcore hot (!) titts .zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\SoftwareDistribution\Download\italian gang bang lesbian full movie cock .mpeg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\danish cum lingerie sleeping .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\japanese gang bang xxx several models YEâPSè& .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\PLA\Templates\blowjob masturbation hole .avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish cum lingerie hidden pregnant (Christine,Melissa).zip.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\spanish gay uncut hole leather .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\cum bukkake public cock gorgeoushorny .rar.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\beast big glans ash .mpg.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\german xxx hot (!) bedroom (Britney,Curtney).avi.exe	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2924	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2544	2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	27
PID 2504 wrote to memory of 2544	2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	27
PID 2504 wrote to memory of 2544	2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	27
PID 2504 wrote to memory of 2544	2504	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	27
PID 2544 wrote to memory of 2924	2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	28
PID 2544 wrote to memory of 2924	2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	28
PID 2544 wrote to memory of 2924	2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	28
PID 2544 wrote to memory of 2924	2544	cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe	28

C:\Users\Admin\AppData\Local\Temp\cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
"C:\Users\Admin\AppData\Local\Temp\cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
  "C:\Users\Admin\AppData\Local\Temp\cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe
    "C:\Users\Admin\AppData\Local\Temp\cd52c1b758221d4711bd40ca1c8e272575cf2ae626e58a49a77b33b84e4ee0af.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\beast sleeping .mpg.exe

Filesize
526KB

MD5
24215b8f7b3a484ad8a842cd5e247c0f

SHA1
5c1e026e5a0eeeb767e6759eba9fb016b923c071

SHA256
d89a4a736ceb0cd3e67e511de147579c6bd02caa2a19939e70901e4e00c468dc

SHA512
92aae828e0fc14d9e922ee06ba15a13c919b4aed26b3356993c1aaa870d0ddf1cb45f2030860c1aac520ed6c2ab2b41653a3b94a4b0a2486c3896fd21a3af916

Download Submit
C:\debug.txt

Filesize
183B

MD5
224e21d9a81bf0446e135cf3d308d838

SHA1
d242041c31af9637bd63263249436ff42171dda6

SHA256
f06f7a6f6754cd1a46c18e27e8a7e07705aed580c2cab672e1ac4c6cde3941ee

SHA512
6a5c5af37875ea66c36a638e309f9ccfbaf3b859d5efb9ba7530f02892859ad747aaae468fb5ede25efbd070a933deb057fb4a13e8554731221d7b5234e16266

Download Submit
memory/2504-117-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-142-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-101-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-68-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-18-0x0000000004950000-0x000000000496F000-memory.dmp

Filesize
124KB

Download
memory/2504-95-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-96-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-97-0x0000000004950000-0x000000000496F000-memory.dmp

Filesize
124KB

Download
memory/2504-145-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-110-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-107-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-104-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-114-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-125-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2504-120-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2544-20-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2544-69-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2544-63-0x0000000004900000-0x000000000491F000-memory.dmp

Filesize
124KB

Download
memory/2544-100-0x0000000004900000-0x000000000491F000-memory.dmp

Filesize
124KB

Download
memory/2924-81-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2924-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download