9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8

General

Target

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
Size

318KB
MD5

2576b26a13bf81da3b24607ddd81524c
SHA1

f4f4f2f75aa38ee03f933933a222b0f62b105baf
SHA256

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8
SHA512

0524c1615a0db28d7a53169891a15b0abb4f0834bd21eb4873714bc6b0faa84114254969f9b7bf6e060056efc0dbeb4963f7347146226421003103fd3cfae44b
SSDEEP

6144:aDOxZXrSHXUTs/HZSkMLmSEJMYh1yaicA8vmaZonz2ZIfd3nUV1qUfUtx:lXa8s/HZSknS8Jh1/AsoqZIfd3U39ctx

Score

9^/10

persistence spyware stealer

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-0-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2800-66-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-91-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-95-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3032-105-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-106-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-107-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-112-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-115-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-118-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-123-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-126-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-129-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-132-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-135-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-138-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-141-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-144-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1684-147-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-0-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
C:\Program Files\Windows Sidebar\Shared Gadgets\american kicking lesbian masturbation feet penetration .rar.exe	UPX
behavioral1/memory/2800-66-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3032-91-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-95-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3032-105-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-106-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-107-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-112-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-115-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-118-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-123-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-126-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-129-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-132-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-135-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-138-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-141-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-144-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/1684-147-0x0000000000400000-0x000000000041C000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

description	ioc	process
File opened (read-only)	\??\B:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\O:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\P:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\R:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\T:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\A:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\I:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\J:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\M:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\Q:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\S:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\Z:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\E:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\U:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\W:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\Y:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\G:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\H:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\K:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\L:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\N:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\V:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File opened (read-only)	\??\X:	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

Drops file in System32 directory 10 IoCs

Processes:

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

description	ioc	process
File created	C:\Windows\SysWOW64\IME\shared\russian hardcore [free] (Britney,Ashley).mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SysWOW64\config\systemprofile\cum [free] ash redhair .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\beastiality horse hidden ash young .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SysWOW64\IME\shared\handjob horse girls .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SysWOW64\config\systemprofile\italian beastiality horse voyeur feet (Liz).zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SysWOW64\FxsTmp\russian hardcore girls .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\System32\DriverStore\Temp\chinese kicking voyeur upskirt .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SysWOW64\FxsTmp\chinese handjob uncut .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\gay beast catfight .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black porn lesbian public blondie .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

Drops file in Program Files directory 15 IoCs

Processes:

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Office\Templates\norwegian kicking public .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian beastiality horse lesbian mature .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\american kicking lesbian masturbation feet penetration .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\gay big .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Google\Update\Download\sperm gang bang sleeping leather .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\kicking porn full movie .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\british lesbian lesbian balls (Jenna).zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\spanish sperm trambling full movie girly .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files\DVD Maker\Shared\black kicking public .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Google\Temp\norwegian lesbian animal several models ash leather .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\fetish several models glans (Melissa).rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\swedish nude big leather .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files\Common Files\Microsoft Shared\german handjob nude [milf] .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files\Windows Journal\Templates\canadian animal catfight .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\indian porn hidden cock high heels .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

Drops file in Windows directory 64 IoCs

Processes:

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\horse uncut .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\french beast fetish public nipples .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\porn masturbation (Karin,Gina).avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\black xxx several models .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\lesbian cumshot several models cock .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\french cumshot public circumcision (Kathrin,Gina).mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\mssrv.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\tyrkish porn big sm .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\chinese gay hidden feet fishy (Curtney).rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\fucking hot (!) lady .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\bukkake girls wifey .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\british fucking voyeur nipples girly (Sonja).zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\italian gay [free] redhair .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\asian animal public glans .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\malaysia hardcore fucking [bangbus] .mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\horse girls .mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\japanese cum hot (!) cock .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\trambling [milf] .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\chinese nude fucking voyeur circumcision .mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\horse cum uncut boobs .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\security\templates\chinese beastiality public .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\nude lingerie full movie boobs (Gina).mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\norwegian lingerie masturbation vagina leather .mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\swedish cum lesbian nipples stockings .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\spanish fucking voyeur .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\kicking animal [bangbus] boobs bedroom .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\american gay full movie stockings .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\animal gang bang masturbation vagina latex .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\american blowjob kicking voyeur feet sweet .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\danish trambling hardcore masturbation shower (Gina).avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\chinese sperm [free] sweet .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\russian animal fucking hidden blondie .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\swedish trambling lingerie licking boots .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\brasilian animal blowjob public circumcision .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\tyrkish gay licking legs 40+ .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\tyrkish gang bang gay big .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\SoftwareDistribution\Download\swedish blowjob gang bang uncut castration (Gina,Sarah).mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\french animal hidden .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse nude public high heels .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\japanese lesbian gang bang [bangbus] .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\swedish handjob blowjob public girly .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian kicking public nipples sm .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\lesbian hardcore [bangbus] cock swallow (Jade,Ashley).avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\trambling gay [free] mature (Sonja).mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\japanese gay masturbation cock .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\chinese handjob [milf] hole balls .mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\african animal beastiality voyeur titts (Liz).avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\swedish bukkake action hot (!) lady (Sandy,Jenna).mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\norwegian beast action voyeur girly .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\horse lesbian licking balls (Jade,Kathrin).rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\spanish sperm full movie lady .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\lesbian girls hotel .zip.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\russian kicking blowjob hidden hairy .avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\Downloaded Program Files\lesbian voyeur feet .mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\porn nude hidden 40+ (Anniston).rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\horse sleeping (Sonja,Jade).mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_dba3691c6002e10e\cumshot hot (!) fishy (Sonja).rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_515dc677700303ec\american beastiality licking young .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\gay public femdom .rar.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\fucking hidden granny .mpg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\fetish public .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\sperm [bangbus] latex .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\animal voyeur upskirt .mpeg.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\japanese cumshot voyeur (Karin,Jenna).avi.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

pid	process
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
3032	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

description	pid	process	target process
PID 1684 wrote to memory of 2800	1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
PID 1684 wrote to memory of 2800	1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
PID 1684 wrote to memory of 2800	1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
PID 1684 wrote to memory of 2800	1684	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
PID 2800 wrote to memory of 3032	2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
PID 2800 wrote to memory of 3032	2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
PID 2800 wrote to memory of 3032	2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
PID 2800 wrote to memory of 3032	2800	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe	9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe

C:\Users\Admin\AppData\Local\Temp\9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
"C:\Users\Admin\AppData\Local\Temp\9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
"C:\Users\Admin\AppData\Local\Temp\9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2800

C:\Users\Admin\AppData\Local\Temp\9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe
"C:\Users\Admin\AppData\Local\Temp\9da8b08c1568e8e09a147b1965904d52eec0d42039f7673d0c19a9bab87ccbb8.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\american kicking lesbian masturbation feet penetration .rar.exe

Filesize
121KB

MD5
dd36cc66e53289ad94e090c0980ab1ae

SHA1
91f160c9175271777179a1a04813125f4bfcea9c

SHA256
f89fc49ad3b26c7dce97e68a9331349966c7990b8e05f0c9691792a25a99aec0

SHA512
6a0e9453b90b305df71902e576028d209803f95b2db5cc16a664cb4cea6ba6bf134e2ebaa4bb8d3521fcd11c2ca9c7cedb58d607bd14ce03d2e7d4928693a80f

Download Submit
memory/1684-112-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-129-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-144-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-95-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-106-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-107-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-115-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-135-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-147-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-109-0x0000000004E00000-0x0000000004E1C000-memory.dmp

Filesize
112KB

Download
memory/1684-118-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-123-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-126-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-65-0x0000000004E00000-0x0000000004E1C000-memory.dmp

Filesize
112KB

Download
memory/1684-132-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2800-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2800-90-0x0000000004F10000-0x0000000004F2C000-memory.dmp

Filesize
112KB

Download
memory/2800-111-0x0000000004F10000-0x0000000004F2C000-memory.dmp

Filesize
112KB

Download
memory/3032-105-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3032-91-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads