Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 23:08
Behavioral task
behavioral1
Sample
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe
Resource
win10v2004-20240419-en
General
-
Target
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe
-
Size
1.7MB
-
MD5
8e3b524f6929036e65af648eb2237e93
-
SHA1
ecdad9d4a32eb5b8c14b886abe4009788ca835e4
-
SHA256
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a
-
SHA512
c50ccc785339ede9eb606c2cf27a1e866d59fb4ba61be831feb81cf52f565648238f3383918977586efd9762f1542349a25fcca5f184ee42f29a111622ec4e21
-
SSDEEP
24576:0MGguBStQGQFvvZp+aWUOU/doI5Col78eJbqgiLHjzQPLcrIGBNgfbLOytW:1GHNFX/x1oI5ColL2giDAPLcGbe
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 21 IoCs
Processes:
resource yara_rule behavioral2/memory/2128-69-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/748-167-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2576-168-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-187-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2128-188-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/748-189-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2576-190-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-192-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-193-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-199-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-209-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-213-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-218-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-222-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-226-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-230-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-234-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-238-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-242-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-246-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4416-250-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 23 IoCs
Processes:
resource yara_rule behavioral2/memory/4416-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\italian porn beast uncut shoes .mpg.exe UPX behavioral2/memory/2128-69-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/748-167-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2576-168-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-187-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2128-188-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/748-189-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2576-190-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-192-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-193-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-199-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-209-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-213-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-218-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-222-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-226-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-230-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-234-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-238-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-242-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-246-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/4416-250-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe Key value queried \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4416-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\italian porn beast uncut shoes .mpg.exe upx behavioral2/memory/2128-69-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/748-167-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2576-168-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-187-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2128-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/748-189-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2576-190-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-192-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-193-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-199-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-209-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-213-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-218-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-222-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-226-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-230-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-234-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-238-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-242-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-246-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/4416-250-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exedescription ioc process File opened (read-only) \??\I: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\K: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\Q: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\B: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\G: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\M: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\X: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\J: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\N: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\S: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\W: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\A: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\H: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\O: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\P: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\R: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\T: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\U: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\V: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\E: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\L: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\Y: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File opened (read-only) \??\Z: 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe -
Drops file in System32 directory 12 IoCs
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\danish kicking bukkake [bangbus] feet upskirt (Sylvia).zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\System32\DriverStore\Temp\horse lesbian latex .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\FxsTmp\gay girls boots .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\IME\SHARED\beast hot (!) (Samantha).zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\russian action hardcore [milf] balls .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\config\systemprofile\fucking full movie girly (Jenna,Janette).rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\IME\SHARED\tyrkish cumshot trambling voyeur castration .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\trambling full movie balls .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\swedish gang bang beast big lady .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\indian cumshot hardcore hot (!) glans (Kathrin,Tatjana).mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\italian cumshot fucking full movie shower .mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SysWOW64\FxsTmp\horse hidden hole young .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe -
Drops file in Program Files directory 18 IoCs
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\french fucking catfight .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Common Files\microsoft shared\russian handjob horse masturbation penetration .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\dotnet\shared\gay sleeping black hairunshaved .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\swedish action blowjob sleeping .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\trambling masturbation granny .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files (x86)\Google\Temp\fucking public 50+ .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files (x86)\Google\Update\Download\japanese cum hardcore several models .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black kicking sperm licking glans .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Microsoft Office\root\Templates\american fetish trambling voyeur titts .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\italian porn beast uncut shoes .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Microsoft Office\Updates\Download\brasilian horse gay [milf] glans granny .rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\trambling lesbian glans 50+ .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\sperm girls ,Ó (Sandy,Jade).mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files (x86)\Microsoft\Temp\beast uncut .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\tyrkish cumshot lesbian hidden .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\beast public glans bondage .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\horse masturbation cock lady (Tatjana).zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african xxx catfight ejaculation .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe -
Drops file in Windows directory 64 IoCs
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exedescription ioc process File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\lingerie lesbian mature .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\japanese beastiality gay sleeping glans 50+ .mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\fetish blowjob voyeur .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\gang bang sperm catfight (Liz).avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\lesbian catfight penetration (Christine,Curtney).mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_b201c2e68d8dbc0d\asian trambling voyeur (Sylvia).rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\nude hardcore hot (!) gorgeoushorny .mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\handjob beast full movie (Samantha).mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\horse [bangbus] hole .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\bukkake sleeping titts ash .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\porn beast [bangbus] ash .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\canadian blowjob sleeping feet Ôï .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\norwegian gay big Ôï .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\german hardcore [bangbus] .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\kicking bukkake public hole granny .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\gay [bangbus] hole fishy .rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\sperm full movie feet .rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\chinese beast sleeping YEâPSè& .rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\hardcore several models titts .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\bukkake uncut hole .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\hardcore big (Sylvia).rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_fe0807c37141be7a\asian lingerie public hole .mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\german lingerie uncut balls .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\xxx [bangbus] .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-moimeexe_31bf3856ad364e35_10.0.19041.746_none_d01527cffa9c25bc\gang bang gay public cock shoes .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\security\templates\brasilian animal fucking uncut hole granny .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\italian handjob beast uncut (Janette).zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\handjob bukkake girls feet .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\black animal blowjob catfight hole sweet (Sarah).rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\action lingerie several models .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\nude lingerie full movie (Curtney).mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\black action trambling sleeping 40+ .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\beast lesbian feet ash (Sylvia).avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\sperm hot (!) .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\horse blowjob licking Ôï .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\brasilian action xxx catfight .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\nude bukkake [free] stockings .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\fetish fucking sleeping mature (Christine,Janette).rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_887b2378b7b5651d\horse hidden .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\indian nude hardcore [milf] hairy .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\bukkake [free] 40+ .rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\swedish action hardcore hot (!) cock pregnant .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\horse [free] titts gorgeoushorny (Sarah).rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\gay lesbian sm .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\french xxx hot (!) .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\japanese handjob bukkake voyeur penetration .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\british sperm [milf] hole .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\indian gang bang horse uncut hole pregnant (Curtney).zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\Temp\lesbian hot (!) feet (Sonja,Samantha).avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\american beastiality lingerie several models boots .mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\japanese porn bukkake [free] .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\tyrkish horse lingerie [free] glans (Sonja,Tatjana).mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\fucking catfight hole fishy .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_a4f93129c473df49\beastiality lesbian public (Curtney).zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\spanish trambling hot (!) shoes (Kathrin,Melissa).zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\danish cum lingerie several models castration .avi.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\swedish action bukkake masturbation titts high heels .mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\beastiality horse masturbation pregnant .rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\african beast sleeping (Curtney).mpeg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\black horse blowjob licking femdom .rar.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\tyrkish kicking bukkake masturbation hole penetration (Jade).mpg.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\british bukkake licking 50+ .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_16bd831fd16633be\british horse lesbian feet mistress .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_4c5922428a6f2d08\lesbian sleeping titts girly .zip.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exepid process 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2576 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 748 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exedescription pid process target process PID 4416 wrote to memory of 2128 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 4416 wrote to memory of 2128 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 4416 wrote to memory of 2128 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 4416 wrote to memory of 748 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 4416 wrote to memory of 748 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 4416 wrote to memory of 748 4416 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 2128 wrote to memory of 2576 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 2128 wrote to memory of 2576 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe PID 2128 wrote to memory of 2576 2128 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe 7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"C:\Users\Admin\AppData\Local\Temp\7db60364692ee02f8fbae7c4c1322bfb0f6e4f75ca15322b14fe77fe31ef1a6a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\italian porn beast uncut shoes .mpg.exeFilesize
701KB
MD5d64141b19573504f69d4a4671a9759dd
SHA1fa2468c2bc62bc29c0995e8ead951b33b0828f81
SHA2562a0bd6b7c9aa62b5eb0e6196133bfe6fb31006a39177dfaea38611def0db1e24
SHA5127733b42fd71ba8e8afaabd6a0c8da6e9e7ce7175e411ffbc121beedda18ec9caf7452ea0f493187b7809257bf35696048ffecd5e146ac1dedb0d5507121e19d4
-
memory/748-189-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/748-167-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2128-69-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2128-188-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2576-168-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2576-190-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-193-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-218-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-192-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-199-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-209-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-213-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-187-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-222-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-226-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-230-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-234-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-238-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-242-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-246-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-250-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB