aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
Size

746KB
MD5

a7b883f33d2e969fa33dea07664a24eb
SHA1

8ede0f35b52dc8108c73132c2dae8259c27c3263
SHA256

aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea
SHA512

413006270fe0c8c88f8f5144c77480d352ddff49d6a69fc71350651d5e7e9fbb7ba0c8d4dbe8048a035fd101c22a7eaf4446176176e971a410a16e03b05d54c2
SSDEEP

12288:VEQoSfqrFcdaxW5ea3YOusit63WvVEElcAC3K2rbItt5y7dK0W6l3+YjjRUeZR:V3cxR+OsitxSElXIHIn5wdh3lpVX

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 19 IoCs

resource	yara_rule
behavioral1/memory/2152-0-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2460-67-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-95-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2460-104-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3040-105-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-106-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-107-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-112-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-115-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-118-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-123-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-126-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-129-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-132-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-135-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-138-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-141-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-144-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2152-147-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 22 IoCs

resource	yara_rule
behavioral1/memory/2152-0-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/files/0x0007000000014817-5.dat	UPX
behavioral1/memory/2460-67-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3040-91-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2460-90-0x0000000004A00000-0x0000000004A1E000-memory.dmp	UPX
behavioral1/memory/2152-95-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2460-104-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/3040-105-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-106-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-107-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-112-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-115-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-118-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-123-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-126-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-129-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-132-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-135-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-138-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-141-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-144-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2152-147-0x0000000000400000-0x000000000041E000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2152-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0007000000014817-5.dat	upx
behavioral1/memory/2460-67-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3040-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2460-90-0x0000000004A00000-0x0000000004A1E000-memory.dmp	upx
behavioral1/memory/2152-95-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2460-104-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3040-105-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-106-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-107-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-112-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-115-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-118-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-123-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-126-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-129-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-132-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-135-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-138-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-141-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-144-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2152-147-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\N:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\A:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\H:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\Q:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\R:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\S:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\U:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\X:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\G:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\L:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\M:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\O:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\P:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\T:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\W:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\K:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\I:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\J:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\V:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\Y:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\Z:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File opened (read-only)	\??\B:	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\blowjob uncut glans latex .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\System32\DriverStore\Temp\horse full movie hole .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\SysWOW64\FxsTmp\japanese animal hardcore full movie upskirt .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\SysWOW64\config\systemprofile\fucking masturbation hole .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\beast voyeur bedroom .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\SysWOW64\config\systemprofile\indian horse horse hot (!) (Tatjana).mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\SysWOW64\IME\shared\danish porn gay masturbation feet .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish kicking fucking [milf] lady .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\SysWOW64\FxsTmp\brasilian porn sperm voyeur ash .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\SysWOW64\IME\shared\italian nude lesbian [bangbus] hole (Sonja,Curtney).avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\danish beastiality lesbian masturbation cock mature .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\bukkake sleeping circumcision .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files\DVD Maker\Shared\american nude sperm big glans leather (Liz).avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Google\Temp\bukkake [milf] feet .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Google\Update\Download\gay hidden .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\indian nude gay hidden glans shower (Curtney).avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\brasilian beastiality trambling catfight feet beautyfull (Curtney).mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\xxx public bedroom .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian handjob bukkake public boots .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files\Windows Journal\Templates\danish beastiality blowjob full movie titts .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\beast voyeur .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\horse big cock shoes .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\italian kicking lesbian voyeur black hairunshaved .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files\Common Files\Microsoft Shared\indian beastiality sperm catfight wifey .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\bukkake public beautyfull .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\japanese animal xxx licking .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\malaysia lingerie several models (Sylvia).rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\action hardcore [milf] feet .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\blowjob voyeur lady .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\spanish horse several models glans balls (Samantha).rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\spanish lesbian lesbian glans granny .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\gay voyeur titts boots .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\kicking fucking masturbation mature .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\british sperm [free] (Karin).avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\asian lingerie sleeping feet granny (Tatjana).zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\german trambling masturbation lady .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\french blowjob hidden (Samantha).zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\american cumshot hardcore hidden .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\security\templates\xxx uncut titts sweet .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\trambling licking titts .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\beastiality xxx [milf] (Liz).mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\brasilian kicking gay public glans (Britney,Jade).mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\danish handjob lesbian masturbation glans lady .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\canadian beast catfight (Tatjana).mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\lingerie masturbation glans hotel (Melissa).mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\chinese trambling masturbation .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\mssrv.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\american action blowjob voyeur titts .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\porn horse [milf] (Melissa).avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\norwegian blowjob licking swallow (Sonja,Curtney).zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black gang bang bukkake licking sm .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\norwegian blowjob [free] cock circumcision .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\italian gang bang xxx lesbian .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\african fucking big mature .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\indian handjob trambling [milf] cock .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\InstallTemp\russian cum blowjob licking swallow (Ashley,Curtney).rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\handjob beast sleeping sweet .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\black cumshot beast big circumcision (Jenna,Melissa).zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\horse sperm girls .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\fucking several models gorgeoushorny .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\Downloaded Program Files\trambling public (Liz).rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\tyrkish animal gay hot (!) cock (Anniston,Curtney).avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\danish gang bang lingerie sleeping (Liz).mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\spanish blowjob [bangbus] shower .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\hardcore girls mature .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\russian animal trambling hidden 40+ .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\gang bang blowjob masturbation (Liz).rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\danish beastiality xxx [free] (Samantha).mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\german beast uncut black hairunshaved .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\horse hardcore hot (!) titts .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\german trambling licking titts .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\cum fucking lesbian beautyfull .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\black animal hardcore several models circumcision .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\malaysia fucking [bangbus] feet castration .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\russian horse hardcore [milf] bedroom .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\asian lingerie [bangbus] .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\norwegian fucking [free] cock .zip.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\lingerie [bangbus] 40+ .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\italian porn lesbian girls hole boots (Melissa).mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\british sperm uncut 40+ .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\chinese trambling [milf] 40+ .rar.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\danish kicking lingerie [bangbus] hairy .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\black nude horse catfight feet penetration .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\danish animal fucking several models hole pregnant (Samantha).avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian full movie hole .mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\fucking [bangbus] hole .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\gay [bangbus] glans balls .mpg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\german blowjob several models (Liz).mpeg.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\indian kicking beast sleeping .avi.exe	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
3040	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2460	2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	28
PID 2152 wrote to memory of 2460	2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	28
PID 2152 wrote to memory of 2460	2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	28
PID 2152 wrote to memory of 2460	2152	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	28
PID 2460 wrote to memory of 3040	2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	29
PID 2460 wrote to memory of 3040	2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	29
PID 2460 wrote to memory of 3040	2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	29
PID 2460 wrote to memory of 3040	2460	aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe	29

C:\Users\Admin\AppData\Local\Temp\aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
"C:\Users\Admin\AppData\Local\Temp\aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
  "C:\Users\Admin\AppData\Local\Temp\aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe
    "C:\Users\Admin\AppData\Local\Temp\aff05e83fe66f88a09133014df4bb1f788038c3dea296033a51e751f5521b2ea.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\beast voyeur .zip.exe

Filesize
2.0MB

MD5
cc092ea7a2dddf082e0dbe8bd5584012

SHA1
1801e195ef2651380bc777770959a98a7d7ab2e5

SHA256
2486bb56fca4c7bb0be63b7e5b2e51774dd48e762680931426d48f701dfc2b43

SHA512
c92a005f7c43e6910d2109c0fb0b5cb992f5fa80e0c8bfac57c8a44e1dbf6db361aa747b01285fbcd360ef9c0b6e7f687757cd8a96b7dfdbc6ed1000349357cd

Download Submit
memory/2152-129-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-107-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-147-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-144-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-95-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-109-0x0000000001FC0000-0x0000000001FDE000-memory.dmp

Filesize
120KB

Download
memory/2152-138-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-106-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-132-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-66-0x0000000001FC0000-0x0000000001FDE000-memory.dmp

Filesize
120KB

Download
memory/2152-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-126-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-115-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-118-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-123-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-112-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2152-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2460-110-0x0000000004A00000-0x0000000004A1E000-memory.dmp

Filesize
120KB

Download
memory/2460-104-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2460-90-0x0000000004A00000-0x0000000004A1E000-memory.dmp

Filesize
120KB

Download
memory/2460-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3040-105-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3040-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download