Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 01:07
Behavioral task
behavioral1
Sample
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe
Resource
win10v2004-20240419-en
General
-
Target
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe
-
Size
1.9MB
-
MD5
d93845030bc22186288a1de23543ff47
-
SHA1
e3e0cf819f8e49094e1c6c22e497ae82c7e78c3f
-
SHA256
aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d
-
SHA512
7d09c0a955192e59c4b3ed5949242b33706de9b0cdb2d8597eac280e64bd74da666bbc8a368a5f5c5f3f09e3535a17a1104c85805d1564b797d6e8949d77f967
-
SSDEEP
49152:+FqliZ/wFntPHsj8I/bu2euB//cd/sOX19di0bb6bBU5:+miZ/2tfsj8iXBHUX13MBi
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 19 IoCs
resource yara_rule behavioral2/memory/2752-158-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2464-157-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-185-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3176-186-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2464-187-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2752-188-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-190-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-196-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-207-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-211-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-216-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-220-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-224-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-228-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-232-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-236-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-240-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-244-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/668-248-0x0000000000400000-0x000000000041B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/memory/668-0-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/files/0x000b000000023b93-5.dat UPX behavioral2/memory/2752-158-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2464-157-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-185-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/3176-186-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2464-187-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/2752-188-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-190-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-196-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-207-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-211-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-216-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-220-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-224-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-228-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-232-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-236-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-240-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-244-0x0000000000400000-0x000000000041B000-memory.dmp UPX behavioral2/memory/668-248-0x0000000000400000-0x000000000041B000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe Key value queried \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/668-0-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/files/0x000b000000023b93-5.dat upx behavioral2/memory/2752-158-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2464-157-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-185-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/3176-186-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2464-187-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/2752-188-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-190-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-196-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-207-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-211-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-216-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-220-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-224-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-228-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-232-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-236-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-240-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-244-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral2/memory/668-248-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\S: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\X: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\A: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\B: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\G: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\M: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\P: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\T: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\V: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\Y: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\I: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\J: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\N: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\O: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\Q: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\Z: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\E: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\H: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\K: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\L: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\U: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File opened (read-only) \??\W: aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\asian porn several models sweet (Curtney).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese beast cumshot full movie granny .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\FxsTmp\swedish sperm gang bang uncut redhair .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\IME\SHARED\brasilian nude lingerie masturbation balls .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\malaysia cumshot action catfight sm (Christine,Gina).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american cumshot cumshot big .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\config\systemprofile\nude [free] ejaculation .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\FxsTmp\norwegian fucking lesbian hidden (Christine,Christine).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\american cumshot horse masturbation .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\System32\DriverStore\Temp\cumshot handjob sleeping mature (Karin,Melissa).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SysWOW64\IME\SHARED\nude catfight wifey .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\norwegian gang bang bukkake several models 40+ .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Drops file in Program Files directory 17 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\british fucking hidden cock (Melissa,Curtney).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\tyrkish lingerie lingerie [bangbus] beautyfull .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\cumshot action [bangbus] mature (Ashley,Sonja).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fucking lesbian .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Google\Update\Download\malaysia trambling girls legs YEâPSè& .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Common Files\microsoft shared\norwegian lesbian hot (!) mature (Jade,Sonja).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\chinese cum [milf] .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\porn cum voyeur bondage (Jenna,Gina).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\gang bang girls feet .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Google\Temp\beast cum [milf] glans .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Microsoft Office\root\Templates\malaysia sperm [bangbus] .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\kicking voyeur .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german animal hot (!) glans hairy .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\horse catfight (Sylvia,Ashley).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files\Microsoft Office\Updates\Download\trambling fucking hidden mature .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\beast hidden circumcision .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\lingerie lesbian girls .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\sperm horse several models granny .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4e52f411b7b0526\canadian lesbian porn public .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\african lingerie gay [free] vagina femdom .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\japanese fucking sleeping balls .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\spanish trambling several models upskirt .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\beastiality hardcore [free] .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\french beast public nipples boots (Anniston).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\beast xxx sleeping ejaculation .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\gang bang lesbian voyeur .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\african gay nude big hole swallow (Sonja).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_de-de_21122d7205c6f5b9\italian blowjob several models vagina (Tatjana,Janette).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\black bukkake horse big beautyfull .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\InputMethod\SHARED\asian horse porn [free] .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\italian kicking bukkake [milf] bondage .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_2426cc56d654beaa\russian bukkake voyeur balls (Janette).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_c049dbdb4e15bdd2\african handjob [bangbus] upskirt (Karin).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_b6514808f7d87b1a\indian beast cum [bangbus] Ôï .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\cum nude hidden .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\tyrkish gang bang cumshot [bangbus] glans gorgeoushorny .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\beast girls nipples .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\norwegian fetish fucking uncut .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\horse hidden beautyfull (Liz).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\trambling several models (Anniston,Sarah).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\xxx uncut titts .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\indian cum voyeur .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_1bbb9ab9fc52bac9\animal uncut pregnant .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\spanish sperm animal full movie legs femdom .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\cumshot [milf] ash .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_es-es_8da1621e0a800290\tyrkish action several models fishy .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_b597a55b603b537d\cum full movie YEâPSè& .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\german kicking action several models boots (Ashley,Curtney).avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\tyrkish nude bukkake licking vagina circumcision .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\horse animal licking redhair .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\canadian cum voyeur .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\malaysia kicking lesbian YEâPSè& .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\sperm kicking full movie hole granny .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\beast public .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\cumshot hot (!) .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_833abdc06c68d338\tyrkish xxx uncut cock hotel .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.546_none_cd016aa683e5a345\british nude [bangbus] stockings (Jade,Tatjana).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\gay bukkake public mature (Britney).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\african blowjob lesbian hot (!) mistress .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\norwegian animal fucking voyeur glans swallow .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\porn several models (Jenna).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\horse lesbian voyeur .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\italian horse animal sleeping .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\fetish masturbation young .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\asian nude beast voyeur sm .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\handjob [milf] legs .zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\british bukkake uncut upskirt (Liz).rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\assembly\tmp\indian cumshot lingerie hot (!) boobs leather .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\canadian trambling lesbian titts leather (Sylvia).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\russian xxx xxx big mistress .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\norwegian handjob action hot (!) .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\german beast sleeping shower .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\bukkake fetish lesbian wifey .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\german lesbian public YEâPSè& .mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\indian animal trambling several models titts .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\beastiality catfight ejaculation .rar.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3058d81cfd5218f2\beast nude hot (!) .avi.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\african cumshot [milf] ash 50+ (Sonja).mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\british nude several models (Anniston,Ashley).mpg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\hardcore beastiality full movie .mpeg.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\german trambling lesbian girls legs (Jade).zip.exe aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2752 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 2464 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 668 wrote to memory of 3176 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 88 PID 668 wrote to memory of 3176 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 88 PID 668 wrote to memory of 3176 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 88 PID 3176 wrote to memory of 2464 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 89 PID 3176 wrote to memory of 2464 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 89 PID 3176 wrote to memory of 2464 3176 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 89 PID 668 wrote to memory of 2752 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 90 PID 668 wrote to memory of 2752 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 90 PID 668 wrote to memory of 2752 668 aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2464
-
-
-
C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"C:\Users\Admin\AppData\Local\Temp\aedec642bd3b685bbc7a71d8a2475044caf7c2c13c314fd4d1b9084f0c36df4d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\horse catfight (Sylvia,Ashley).avi.exe
Filesize1.9MB
MD59034153d5a517242bc939811a37a6cb2
SHA162022d9991d045b37895112c6c8c4a7e5fb2ee00
SHA256423d4da8f4b6a1e56de3a7f2758a62310108dd089fa918045157ad434424af48
SHA512ef0902150ceccce02017759e72a22c9aed9b91f376ada4d2dd87ef7cfb5fbd9501ce4833ef3e3494477fbd9baa97bce99cc9792ac6379b2e2e6d1646e243fb17