Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 18:45
Behavioral task
behavioral1
Sample
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe
Resource
win10v2004-20240419-en
General
-
Target
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe
-
Size
1.5MB
-
MD5
594d2949ebcc1aaa8f5821071545a1a7
-
SHA1
057d6110ff635c583c16fbd633fef7d8db3b855b
-
SHA256
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510
-
SHA512
48eb43367adc2a4cdfa1bcc0a0847a148e99ee0eba16a4cf4967c20df70b7a36f8f7b791eec06614e7bf443dd36e13eba91255ccf019d9817d4624e1c601471f
-
SSDEEP
24576:7rO/zU1Vh6SCb79ovinopRUoPCB5y1mgVCeHSTEH277JGrpDJLK56cL7jr2xyZEv:/O/zOvrzaB5ywgVCeHtW7IllFcL7jCxH
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2244-66-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3796-169-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4024-197-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2244-200-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1304-201-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3796-202-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
Processes:
resource yara_rule behavioral2/memory/4024-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\american kicking sperm full movie 40+ .avi.exe UPX behavioral2/memory/2244-66-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1304-168-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3796-169-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/4024-197-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/2244-200-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1304-201-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3796-202-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4024-0-0x0000000000400000-0x000000000041F000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\american kicking sperm full movie 40+ .avi.exe upx behavioral2/memory/2244-66-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1304-168-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3796-169-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4024-197-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2244-200-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1304-201-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3796-202-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exedescription ioc process File opened (read-only) \??\J: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\L: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\N: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\U: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\B: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\E: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\G: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\V: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\Y: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\Z: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\K: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\P: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\R: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\X: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\A: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\I: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\M: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\S: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\T: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\W: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\H: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\O: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File opened (read-only) \??\Q: 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe -
Drops file in System32 directory 12 IoCs
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exedescription ioc process File created C:\Windows\SysWOW64\IME\SHARED\lesbian masturbation (Curtney).avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\config\systemprofile\american nude xxx [free] black hairunshaved (Britney,Liz).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\IME\SHARED\trambling full movie glans .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\japanese cumshot lingerie [milf] young (Sonja,Liz).zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\italian action sperm big feet granny .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\japanese nude hardcore hidden (Tatjana).mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\config\systemprofile\tyrkish fetish hardcore hidden .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\FxsTmp\beast big glans 40+ (Liz).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\american action fucking masturbation hotel .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\System32\DriverStore\Temp\swedish animal hardcore voyeur hole hairy (Curtney).avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\FxsTmp\action horse masturbation .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\beast several models circumcision .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe -
Drops file in Program Files directory 18 IoCs
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exedescription ioc process File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\horse licking glans blondie (Jade).avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Microsoft Office\root\Templates\trambling big feet balls (Liz).mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie [milf] cock .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\indian kicking trambling hot (!) glans stockings .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\african fucking girls cock .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files (x86)\Google\Update\Download\brasilian fetish lingerie licking (Sylvia).zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Common Files\microsoft shared\horse voyeur (Sylvia).zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\american kicking sperm full movie 40+ .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\xxx [free] glans upskirt .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files (x86)\Google\Temp\russian beastiality beast catfight femdom .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\japanese handjob lingerie hot (!) glans granny .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files (x86)\Microsoft\Temp\russian animal bukkake several models feet .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\sperm sleeping YEâPSè& .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\fucking girls granny .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\tyrkish cum hardcore public hole hairy (Liz).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\russian cum xxx hot (!) titts traffic .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\dotnet\shared\hardcore licking mistress .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Program Files\Microsoft Office\Updates\Download\lesbian voyeur cock hotel .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe -
Drops file in Windows directory 64 IoCs
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\hardcore [free] cock bedroom .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\swedish action bukkake masturbation .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\asian sperm hot (!) sm .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\gay masturbation (Samantha).mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\bukkake girls (Samantha).zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black cumshot hardcore several models feet .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\sperm voyeur black hairunshaved .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\fucking big hole wifey (Janette).mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\british gay [milf] gorgeoushorny .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\norwegian gay masturbation cock blondie .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\bukkake voyeur titts (Anniston,Liz).mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\sperm lesbian .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_de-de_bc04d4fbcc35e12a\british sperm big high heels .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\security\templates\hardcore licking black hairunshaved (Sonja,Karin).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\malaysia beast [bangbus] (Melissa).mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\french lingerie [bangbus] lady .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\canadian lesbian sleeping 40+ .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\african beast girls 50+ .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\african xxx [bangbus] (Janette).avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\cum horse girls hole circumcision .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\beastiality hardcore uncut hole girly .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\bukkake [bangbus] 40+ .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\gang bang lesbian hidden .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\animal lesbian several models cock granny .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\blowjob hot (!) 40+ (Sonja,Tatjana).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\InstallTemp\spanish beast uncut ejaculation .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\malaysia xxx hot (!) ash .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\french fucking public .rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.1_none_24f622f1fc5a3f3c\cum horse hidden mature (Kathrin,Samantha).mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\tyrkish porn fucking sleeping (Sylvia).mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\nude lesbian uncut traffic .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\black kicking gay uncut .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\gay girls feet .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\gang bang blowjob licking .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\CbsTemp\beast lesbian titts .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\black gang bang gay [free] sm (Sonja,Tatjana).mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\canadian lingerie girls glans ejaculation .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\Downloaded Program Files\sperm big (Jade).avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\german fucking hidden boots .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\american kicking hardcore hidden Ôï (Christine,Jade).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_c9ce604ef4cbf323\norwegian hardcore [bangbus] sm .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\nude horse catfight hole .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\canadian lesbian sleeping girly (Gina,Melissa).avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\malaysia hardcore hot (!) feet leather .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_4ab14109a3e1e067\asian lingerie several models (Samantha).zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\lingerie catfight wifey (Christine,Curtney).zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\animal bukkake [bangbus] .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ee7ea14f7d8a3ee3\bukkake masturbation .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\xxx lesbian bondage .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\horse beast hidden hole .mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\horse hardcore [bangbus] titts hotel .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\american cum lingerie hidden hole stockings (Liz).mpg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\swedish animal blowjob big glans mature .mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_10.0.19041.1_none_a3d9a07cf2290837\chinese beast hot (!) (Curtney).zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\indian porn beast [milf] titts swallow .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_10.0.19041.1_none_bd731e5b85dd203e\spanish bukkake [free] .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\chinese blowjob sleeping (Samantha).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\swedish kicking sperm lesbian (Melissa).mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\Temp\tyrkish porn fucking big young (Christine,Sarah).mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\PLA\Templates\american cumshot horse sleeping latex .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\swedish action blowjob licking hole (Christine,Tatjana).mpeg.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_3d077a9cd5de5151\gang bang blowjob [milf] bedroom .zip.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese action fucking voyeur ash .avi.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\bukkake masturbation titts (Anniston,Janette).rar.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exepid process 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 3796 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 1304 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exedescription pid process target process PID 4024 wrote to memory of 2244 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 4024 wrote to memory of 2244 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 4024 wrote to memory of 2244 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 2244 wrote to memory of 1304 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 2244 wrote to memory of 1304 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 2244 wrote to memory of 1304 2244 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 4024 wrote to memory of 3796 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 4024 wrote to memory of 3796 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe PID 4024 wrote to memory of 3796 4024 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe 11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"C:\Users\Admin\AppData\Local\Temp\11d340544eee66a5340ebd29ac70e9b273feab604ceaf59f002c80b5fb7e9510.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\american kicking sperm full movie 40+ .avi.exeFilesize
1.9MB
MD5c8ae1e5731abc05c5bb9c467d1bf6309
SHA17f5ed975a0ba67640314f90ec38be8bc66c690a8
SHA256e9881d23c821b61002ad2ba0f46b0bb03757d3a9f8bedff5ea9deddc6d81334d
SHA512f21e05b76840d9c85f3e9c4a34d7c8b86eab504844688403c8f2ff25261ebd3278961b1b6f45a85106738098c56b6c81fce81553ac0ee3fbd0f8621fb737e309
-
memory/1304-168-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/1304-201-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2244-66-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/2244-200-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3796-169-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/3796-202-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4024-0-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/4024-197-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB