0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031

General

Target

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
Size

120KB
MD5

11459b479c8d64f3b847f9b96372f123
SHA1

fff23879432710324eade7f684094579c69add8c
SHA256

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031
SHA512

c7bc0e5f3d5a1a78124ec4918ba92c3f08ff5080173687f41ce2e4fe3673c879b20844d795d1054c5b22d731aca803fc87d0d940aa6c389b6c4b202fee0ee400
SSDEEP

3072:aDOkexJLFdrPZ1Tj4mYWR/R4nkPR/1aVuyJsf7tETol33wAx62Nv:aDOxZXPIo5R4nM/40yJc7tl33wS/

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1764-95-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2856-104-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/548-105-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-106-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-111-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-114-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-117-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-122-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-125-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-128-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-131-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-134-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-137-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-140-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-143-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1764-146-0x0000000000400000-0x000000000041B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1764-0-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
C:\Program Files\Windows Sidebar\Shared Gadgets\canadian cumshot girls lady .zip.exe	UPX
behavioral1/memory/2856-61-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/548-91-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-95-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2856-104-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/548-105-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-106-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-111-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-114-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-117-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-122-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-125-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-128-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-131-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-134-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-137-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-140-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-143-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/1764-146-0x0000000000400000-0x000000000041B000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1764-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
C:\Program Files\Windows Sidebar\Shared Gadgets\canadian cumshot girls lady .zip.exe	upx
behavioral1/memory/2856-61-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/548-91-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-95-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2856-104-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/548-105-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-106-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-111-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-114-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-117-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-122-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-125-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-128-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-131-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-134-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-137-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-140-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-143-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1764-146-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

description	ioc	process
File opened (read-only)	\??\V:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\E:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\N:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\P:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\S:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\T:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\O:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\U:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\Y:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\A:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\B:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\H:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\I:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\L:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\G:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\J:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\K:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\M:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\X:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\Q:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\R:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\W:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File opened (read-only)	\??\Z:	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

Drops file in System32 directory 10 IoCs

Processes:

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

description	ioc	process
File created	C:\Windows\SysWOW64\FxsTmp\bukkake full movie wifey .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\SysWOW64\config\systemprofile\gay beast hidden ash redhair .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\SysWOW64\IME\shared\japanese hardcore fucking full movie swallow .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\SysWOW64\config\systemprofile\brasilian fucking horse catfight (Kathrin,Sandy).mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian fucking [free] .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\beastiality horse uncut wifey (Samantha,Samantha).mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\german fetish fetish [bangbus] redhair .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\SysWOW64\FxsTmp\norwegian hardcore action [free] blondie .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\System32\DriverStore\Temp\blowjob animal voyeur bedroom .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\SysWOW64\IME\shared\xxx sleeping stockings (Tatjana,Gina).zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

Drops file in Program Files directory 15 IoCs

Processes:

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

description	ioc	process
File created	C:\Program Files\DVD Maker\Shared\indian beast hot (!) blondie .avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\gang bang [milf] hairy (Sandy).avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files\Common Files\Microsoft Shared\gay masturbation hole .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Google\Temp\cumshot action [bangbus] hotel (Anniston,Kathrin).zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\fucking voyeur glans .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\indian lesbian hidden hole lady (Tatjana).avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\black beast [free] bedroom .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\beastiality lesbian catfight sweet .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files\Windows Journal\Templates\handjob handjob hot (!) pregnant .avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\canadian cumshot girls lady .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Google\Update\Download\black trambling porn sleeping latex .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\brasilian lingerie full movie (Curtney,Samantha).mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\tyrkish beast horse public hotel .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\british beast sperm licking swallow .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\gang bang uncut .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

Drops file in Windows directory 64 IoCs

Processes:

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

description	ioc	process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\norwegian lesbian big sm (Ashley,Britney).rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\indian lingerie hot (!) ash high heels .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\trambling beast public vagina ash (Gina,Sarah).zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\bukkake sleeping glans castration .avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\xxx sperm hot (!) ìï .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\french cum hot (!) vagina castration .avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\chinese beastiality horse public upskirt .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\fetish porn sleeping redhair (Anniston).zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\sperm animal sleeping boobs young .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\african porn nude [milf] black hairunshaved .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\asian cum porn hidden .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\french gang bang xxx [free] 50+ .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\american xxx gay sleeping .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\american fetish horse catfight glans ejaculation .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\blowjob nude lesbian hotel (Samantha,Britney).zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\black trambling sleeping .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\lingerie animal hidden penetration .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\danish lingerie public titts .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\xxx girls .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\animal public nipples .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\xxx big ash (Ashley).mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_39374e2435a71b47\german horse lingerie masturbation (Sonja,Melissa).mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\cumshot action sleeping (Sonja).rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\swedish kicking public (Karin,Anniston).avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\action nude catfight stockings (Ashley).mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\animal cum girls wifey .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\french lingerie horse sleeping .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\PLA\Templates\gang bang [milf] ash black hairunshaved .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\russian beastiality trambling full movie traffic .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\norwegian cumshot hardcore masturbation granny (Tatjana).avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\porn horse several models feet .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\security\templates\japanese kicking public glans fishy (Jenna,Kathrin).mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\brasilian xxx public upskirt (Sylvia,Gina).rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\InstallTemp\tyrkish horse catfight .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\fucking beastiality public cock .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\norwegian xxx beastiality [milf] (Samantha,Sarah).avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\blowjob horse uncut young (Kathrin).rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\chinese lesbian horse lesbian cock ìï (Ashley).zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\italian beastiality voyeur nipples castration .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\beast sleeping (Melissa).avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\brasilian hardcore [milf] .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\danish horse catfight nipples (Janette).mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\xxx [free] gorgeoushorny (Melissa,Melissa).mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\chinese hardcore [bangbus] .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\Temp\cumshot voyeur (Jade,Curtney).rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\tyrkish beastiality public hole .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\brasilian cum public vagina sm .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\swedish porn voyeur mature .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\russian hardcore uncut .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\canadian porn sperm girls wifey .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\italian gang bang public ash .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\african cum gang bang [milf] .avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\Downloaded Program Files\gang bang hardcore public gorgeoushorny .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\american blowjob [milf] feet .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\canadian gang bang blowjob girls sweet .zip.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\japanese beastiality horse catfight YEâPSè& .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\assembly\tmp\animal cum masturbation (Karin,Curtney).mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\fucking nude [bangbus] .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\lingerie [bangbus] penetration (Sarah).rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\american hardcore [free] fishy .mpeg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\norwegian cum kicking hot (!) gorgeoushorny .rar.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\italian gang bang several models shower (Kathrin,Anniston).avi.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\malaysia beast animal masturbation granny .mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\german beast porn several models feet (Samantha,Anniston).mpg.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

pid	process
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
548	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

description	pid	process	target process
PID 1764 wrote to memory of 2856	1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
PID 1764 wrote to memory of 2856	1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
PID 1764 wrote to memory of 2856	1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
PID 1764 wrote to memory of 2856	1764	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
PID 2856 wrote to memory of 548	2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
PID 2856 wrote to memory of 548	2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
PID 2856 wrote to memory of 548	2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
PID 2856 wrote to memory of 548	2856	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe	0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe

C:\Users\Admin\AppData\Local\Temp\0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
"C:\Users\Admin\AppData\Local\Temp\0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764

C:\Users\Admin\AppData\Local\Temp\0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
"C:\Users\Admin\AppData\Local\Temp\0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856

C:\Users\Admin\AppData\Local\Temp\0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe
"C:\Users\Admin\AppData\Local\Temp\0baa84d4b855d23fd66ad50914680bc128b6db7a83485fc813d2737eb86b9031.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:548

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\canadian cumshot girls lady .zip.exe
Filesize
703KB

MD5
1dabe6be2a0a2296985d54e49ce2a655

SHA1
bbaec6624568bb9e0382bba3141a6d8825c11f22

SHA256
f0ace6656dc71c33c641c57d95299cd74e4053a6f60fe4bfad91a557a8c7b4fa

SHA512
111f79fc487108710144849a76daaa6374fe62b81613990196edd37dfcd7ba6d9255d4de72706c4a9968a8d144140030ba5710e772728099b106107e3895ff85

Download Submit
C:\debug.txt
Filesize
183B

MD5
ae2ef668d13ccaeaf9df65d5e5c739cd

SHA1
9b5c105bb2f09506261d0b43848201f0caab823e

SHA256
698f35e96fbf34def03cbac3bef94edd86e2126c40c33bd965422f15e668a194

SHA512
46889a74590d97a09b0f5d3a3f6fba26733c9dddbc54bba1330b9781df6e187c929397c338a53d2b2e315fe4e81ab8917eaf69598c266e984f310c8ca251be11

Download Submit
memory/548-91-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/548-105-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-128-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-117-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-95-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-60-0x00000000054D0000-0x00000000054EB000-memory.dmp

Filesize
108KB

Download
memory/1764-146-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-143-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-106-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-109-0x00000000054D0000-0x00000000054EB000-memory.dmp

Filesize
108KB

Download
memory/1764-140-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-111-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-114-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-137-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-122-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-125-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-131-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1764-134-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2856-90-0x0000000000820000-0x000000000083B000-memory.dmp

Filesize
108KB

Download
memory/2856-110-0x0000000000820000-0x000000000083B000-memory.dmp

Filesize
108KB

Download
memory/2856-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2856-104-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads