d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c

General

Target

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
Size

1.5MB
MD5

1b45950fe068059dbc4f580bf0da1da9
SHA1

89591c6439ac583b876abc56bd8af81d0148546d
SHA256

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c
SHA512

a8b24c3a81f50b11cb2cdb21cc3d9dc33063e323bef225bc370b09c74b4dfe2a74ab7829f4cee31ff0b707f30ea46ac9897f5f59bf0106c89f7f062622346b72
SSDEEP

24576:0BPOL9mlF+fTt5VbGJhlTM5ZiVvaGJLrZMOxStDp/0DU+pKETUWMTvg7PH8IhdC:QGJRx5Y74ZiQOtMOgpp/0DUxET3GORS

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2644-60-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1992-89-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-104-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-108-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-111-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-114-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-119-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-122-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-125-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-128-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-131-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-134-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-137-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-140-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-143-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
C:\Program Files\Windows Sidebar\Shared Gadgets\xxx nude big .mpeg.exe	UPX
behavioral1/memory/2644-60-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1992-89-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-104-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-108-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-111-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-114-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-119-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-122-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-125-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-128-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-131-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-134-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-137-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-140-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-143-0x0000000000400000-0x000000000041E000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2980-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
C:\Program Files\Windows Sidebar\Shared Gadgets\xxx nude big .mpeg.exe	upx
behavioral1/memory/2644-60-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1992-89-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-104-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-108-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-111-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-114-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-119-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-122-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-125-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-128-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-131-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-134-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-137-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-140-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-143-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

description	ioc	process
File opened (read-only)	\??\J:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\P:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\Q:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\V:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\Y:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\E:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\H:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\N:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\O:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\R:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\S:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\X:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\A:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\B:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\K:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\T:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\U:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\W:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\Z:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\G:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\I:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\L:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File opened (read-only)	\??\M:	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

Drops file in System32 directory 10 IoCs

Processes:

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish lingerie uncut feet girly (Ashley).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\SysWOW64\FxsTmp\french action action several models boots .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\SysWOW64\IME\shared\hardcore uncut .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\lesbian hidden vagina ¼ç (Janette).avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\nude beastiality catfight penetration (Janette).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\SysWOW64\FxsTmp\british handjob trambling lesbian .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\SysWOW64\config\systemprofile\horse hidden shoes (Karin).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\System32\DriverStore\Temp\canadian hardcore catfight (Melissa).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\SysWOW64\config\systemprofile\gang bang hidden .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\SysWOW64\IME\shared\lesbian masturbation 50+ (Sonja,Ashley).avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

Drops file in Program Files directory 15 IoCs

Processes:

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

description	ioc	process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\xxx nude big .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\canadian horse cum several models ejaculation .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files\DVD Maker\Shared\asian gang bang [free] .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\gang bang beastiality hidden YEâPSè& (Sonja).mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\canadian porn sleeping .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\black handjob masturbation cock Œß .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\swedish beastiality porn voyeur latex .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files\Windows Journal\Templates\african fetish public gorgeoushorny (Sylvia,Liz).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Google\Update\Download\cum horse masturbation .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\norwegian xxx public vagina hotel .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\swedish cumshot uncut gorgeoushorny .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files\Common Files\Microsoft Shared\indian fetish hidden boobs .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Google\Temp\japanese lingerie [free] shower .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\tyrkish beast hardcore public ash mature (Karin).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\beastiality hidden castration .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

Drops file in Windows directory 64 IoCs

Processes:

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

description	ioc	process
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\italian gang bang lingerie licking young .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\italian horse hardcore lesbian hole balls .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\brasilian beastiality [milf] 40+ (Jade,Britney).zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\Temp\tyrkish handjob gang bang lesbian (Gina,Jade).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\swedish blowjob voyeur .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\xxx catfight lady .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\trambling xxx big .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\trambling gay licking traffic .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\beast lingerie uncut girly .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\horse [milf] hole .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\asian nude gang bang licking (Anniston).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\danish lesbian cum hidden .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\nude horse hidden penetration .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\malaysia trambling sleeping traffic (Kathrin,Tatjana).zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\african lesbian horse licking .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\chinese action animal hidden .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\asian sperm kicking [free] granny (Gina,Sandy).mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\spanish beastiality uncut 40+ .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\russian fucking horse voyeur .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\hardcore gay licking (Sarah,Janette).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\malaysia xxx sperm voyeur fishy .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\lesbian licking shoes .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\asian blowjob full movie latex (Sonja).zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\animal kicking girls swallow .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\russian nude [milf] (Liz,Sandy).avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\animal masturbation legs .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\malaysia cumshot handjob hot (!) .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\animal bukkake [bangbus] 50+ .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\british sperm animal hot (!) balls (Sonja,Melissa).zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\canadian lingerie masturbation YEâPSè& (Ashley).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\black gang bang beast big nipples fishy .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\xxx voyeur (Sonja).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\kicking [bangbus] .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\swedish trambling uncut mature (Sonja,Gina).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\asian lingerie horse voyeur (Sandy).avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\russian sperm lesbian several models penetration .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\french bukkake animal public young (Curtney).avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\japanese nude full movie titts black hairunshaved .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\nude big lady .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\japanese gay fetish full movie hole young .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\german bukkake catfight .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\canadian fetish voyeur traffic (Gina,Ashley).mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\horse uncut feet ash (Gina,Jade).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\porn big (Jade).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\swedish bukkake animal [milf] cock leather (Britney).avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\japanese trambling bukkake licking .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\handjob gang bang voyeur traffic .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\french fucking porn full movie titts beautyfull (Christine,Janette).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\action bukkake big mistress .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\indian cumshot uncut (Kathrin,Melissa).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian action [milf] latex (Liz).zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\norwegian hardcore girls (Jenna).mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\swedish cumshot animal licking castration .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\indian xxx full movie sm .mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\cumshot lesbian big boots .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\cum [milf] nipples YEâPSè& (Sonja,Janette).avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\british lingerie nude [bangbus] .rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\malaysia gay animal girls femdom .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\horse nude licking vagina .zip.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\norwegian lesbian lesbian (Britney).rar.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\animal fucking [free] redhair (Karin).mpeg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\black porn animal hot (!) .mpg.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\american blowjob lingerie catfight redhair .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\german trambling full movie young .avi.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exed2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exed2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

pid	process
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
1992	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exed2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

description	pid	process	target process
PID 2980 wrote to memory of 2644	2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
PID 2980 wrote to memory of 2644	2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
PID 2980 wrote to memory of 2644	2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
PID 2980 wrote to memory of 2644	2980	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
PID 2644 wrote to memory of 1992	2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
PID 2644 wrote to memory of 1992	2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
PID 2644 wrote to memory of 1992	2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
PID 2644 wrote to memory of 1992	2644	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe	d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe

C:\Users\Admin\AppData\Local\Temp\d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
"C:\Users\Admin\AppData\Local\Temp\d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980

C:\Users\Admin\AppData\Local\Temp\d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
"C:\Users\Admin\AppData\Local\Temp\d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe
"C:\Users\Admin\AppData\Local\Temp\d2e79e3dab60680f7ae23b9e1ecda34c18b81b7f484311f0e9286d03d4b1282c.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\xxx nude big .mpeg.exe
Filesize
1.9MB

MD5
2e530b93c66d0da520cbd7784cb30d15

SHA1
b97493f2018612efc29a821321ce1ec89f5314aa

SHA256
da58df409923bb79561da67e9a15997dbb687252864d865b3108fa7e48a675ca

SHA512
ab8fb043cfbc92cafd233128be42099b6d0ee1c0e206a91e4667bfd5149b5d89b57e9c7aa6668438c57035a3538868598d7368d023da7f436ac7795d3fc485c5

Download Submit
memory/1992-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2644-88-0x00000000044F0000-0x000000000450E000-memory.dmp

Filesize
120KB

Download
memory/2644-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-111-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-122-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-104-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-107-0x0000000001E90000-0x0000000001EAE000-memory.dmp

Filesize
120KB

Download
memory/2980-108-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-114-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-119-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-59-0x0000000001E90000-0x0000000001EAE000-memory.dmp

Filesize
120KB

Download
memory/2980-125-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-128-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-131-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-140-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-143-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads