bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
Size

923KB
MD5

a62cf5d8d01a2058ca448644cabc7011
SHA1

3822d6b3e9addf61b99bb8f8a74f7cba75341937
SHA256

bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00
SHA512

7ec4e95627365a444dc7357c0195ac959d38bb31a5315c9f97bb25f0fe1af80b0b7350609780345f887459d15fb70a0e4a28c783ccf72afee80225331b990fcd
SSDEEP

24576:VR48Kczljnj5/H0OANlVMik10gKrmcQjnV11:X48H5nj5P0O6z8erxQjV11

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 19 IoCs

resource	yara_rule
behavioral1/memory/2588-58-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-90-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2588-92-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2480-93-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-94-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-96-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-101-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-105-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-119-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-123-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-127-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-131-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-137-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-141-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-145-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-149-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-153-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-157-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 22 IoCs

resource	yara_rule
behavioral1/memory/1612-0-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/files/0x0007000000014a55-5.dat	UPX
behavioral1/memory/1612-16-0x0000000004E70000-0x0000000004E8E000-memory.dmp	UPX
behavioral1/memory/2588-58-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-90-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2588-92-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2480-93-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-94-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-96-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-101-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-105-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-119-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-123-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-127-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-131-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-137-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-141-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-145-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-149-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-153-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-157-0x0000000000400000-0x000000000041E000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1612-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0007000000014a55-5.dat	upx
behavioral1/memory/1612-16-0x0000000004E70000-0x0000000004E8E000-memory.dmp	upx
behavioral1/memory/2588-58-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-90-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2588-92-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2480-93-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-94-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-96-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-101-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-105-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-119-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-123-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-127-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-131-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-137-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-141-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-145-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-149-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-153-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-157-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\L:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\N:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\X:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\E:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\G:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\I:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\J:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\O:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\U:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\V:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\B:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\H:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\K:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\Q:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\R:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\T:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\Y:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\Z:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\M:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\P:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\S:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File opened (read-only)	\??\W:	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\indian porn lingerie [bangbus] .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\fucking big (Samantha).mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lesbian masturbation black hairunshaved .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SysWOW64\FxsTmp\black horse blowjob hidden glans fishy .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\System32\DriverStore\Temp\lingerie hot (!) sm .mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SysWOW64\FxsTmp\american kicking fucking [milf] cock high heels (Tatjana).avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SysWOW64\IME\shared\horse full movie (Janette).rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\russian gang bang lingerie [free] titts ash (Sylvia).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SysWOW64\config\systemprofile\blowjob public glans circumcision .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SysWOW64\IME\shared\italian beastiality lesbian lesbian .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\brasilian action hardcore hot (!) femdom .mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files\Windows Journal\Templates\brasilian beastiality gay hidden feet blondie .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\danish fetish horse hidden traffic .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\japanese horse beast sleeping titts young .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\fucking hidden cock shoes (Liz).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Google\Temp\italian handjob lingerie voyeur feet black hairunshaved (Jade).avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\italian kicking lesbian voyeur titts upskirt .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\lingerie hidden .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\tyrkish kicking bukkake sleeping .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Google\Update\Download\gay sleeping glans wifey .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\trambling full movie .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\blowjob licking feet bedroom .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files\Common Files\Microsoft Shared\american handjob sperm hot (!) feet bondage .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\lesbian hidden castration .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\italian horse beast big cock .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\russian action fucking voyeur hotel .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\Temp\hardcore full movie ash .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\danish action beast [free] titts mature (Melissa).mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\animal bukkake voyeur pregnant .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\bukkake sleeping hole ìï (Curtney).mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\horse lesbian lesbian .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\action lesbian big hole .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\american gang bang xxx sleeping hole shower (Janette).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\blowjob hidden (Tatjana).rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\mssrv.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\PLA\Templates\tyrkish beastiality bukkake sleeping .mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\chinese blowjob sleeping hairy (Sonja,Jade).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\african hardcore hidden (Karin).rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\british gay full movie .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\african bukkake [bangbus] latex (Gina,Sarah).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\beast hidden feet black hairunshaved (Samantha).mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\animal bukkake hot (!) glans young .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\horse uncut hole .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\horse big cock .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\gay [free] shower (Gina,Sylvia).mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\canadian hardcore lesbian feet ejaculation (Melissa).mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\bukkake masturbation cock blondie (Sarah).avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\british blowjob hot (!) feet .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\tyrkish beastiality hardcore [free] .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\danish handjob bukkake [bangbus] .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\gay lesbian .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\indian action fucking [bangbus] leather (Gina,Tatjana).rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\cumshot beast lesbian feet .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\blowjob voyeur redhair .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\handjob blowjob [milf] redhair (Sandy,Melissa).rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\american kicking horse hot (!) hole .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish nude lingerie big hotel .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\chinese lingerie [bangbus] glans .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\porn hardcore public titts .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\italian animal trambling licking granny (Kathrin,Tatjana).avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\swedish nude trambling masturbation ejaculation .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\nude hardcore hot (!) glans stockings (Sarah).mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\german bukkake masturbation cock .mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\tyrkish horse sperm hot (!) .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\kicking hardcore full movie glans swallow .mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\danish kicking horse full movie fishy .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\american nude hardcore hot (!) (Sylvia).mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\gang bang xxx [bangbus] .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\InstallTemp\malaysia lesbian hot (!) cock bedroom .zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\asian xxx lesbian .mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\lesbian licking penetration (Ashley,Melissa).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\italian horse trambling full movie wifey (Jenna,Karin).mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\horse gay masturbation .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\indian porn blowjob hot (!) glans circumcision .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\SoftwareDistribution\Download\fucking hidden feet hotel (Karin).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\nude fucking licking .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\french trambling [free] young (Gina,Melissa).zip.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\horse hot (!) balls .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\cum horse masturbation (Jade).mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\african blowjob licking gorgeoushorny .mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\indian gang bang fucking catfight .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\hardcore uncut glans shoes .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\british fucking masturbation titts .rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\spanish sperm licking .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\french hardcore big young (Britney,Tatjana).rar.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\italian horse lesbian [free] titts stockings (Sarah).mpeg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\porn gay [milf] (Karin).mpg.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\beastiality blowjob [free] mistress .avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\norwegian lingerie [bangbus] glans latex (Curtney).avi.exe	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2480	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
2588	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2980	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	28
PID 1612 wrote to memory of 2980	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	28
PID 1612 wrote to memory of 2980	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	28
PID 1612 wrote to memory of 2980	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	28
PID 1612 wrote to memory of 2588	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	29
PID 1612 wrote to memory of 2588	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	29
PID 1612 wrote to memory of 2588	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	29
PID 1612 wrote to memory of 2588	1612	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	29
PID 2980 wrote to memory of 2480	2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	30
PID 2980 wrote to memory of 2480	2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	30
PID 2980 wrote to memory of 2480	2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	30
PID 2980 wrote to memory of 2480	2980	bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe	30

C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
"C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
  "C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
    "C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2480
- C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe
  "C:\Users\Admin\AppData\Local\Temp\bcada1ec1cb7f97ddc06bb373458a2c72810c6611569349fe17d0a4f9ee43e00.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\lesbian hidden castration .zip.exe

Filesize
534KB

MD5
4faabd277c0dad92dfe7b7c3fc0c2a4d

SHA1
a52634d8206322d699f83493c881dcaac9e74d1d

SHA256
0dfa68a85ab22b2143f7c6bf650739941d51053564145fce0c184541f6199d13

SHA512
c3f5570fb157f5fff5d69c0fe03f9c6087bd1aeed2a5ea16cb607e3b92798c7bccb5db5f463f7153256af4f80223b25a2527f138d80d8091bd6ea07fff6b835b

Download Submit
memory/1612-137-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-131-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-96-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-101-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-90-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-153-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-149-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-145-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-94-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-105-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-57-0x0000000004E80000-0x0000000004E9E000-memory.dmp

Filesize
120KB

Download
memory/1612-157-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-95-0x0000000004E70000-0x0000000004E8E000-memory.dmp

Filesize
120KB

Download
memory/1612-119-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-123-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-127-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-16-0x0000000004E70000-0x0000000004E8E000-memory.dmp

Filesize
120KB

Download
memory/1612-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-141-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2480-93-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2588-92-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2588-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2980-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download