3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
Size

736KB
MD5

3746359ce57f69457411e59757baf4fd
SHA1

4fd2b30e3e9cc3015a2c08b5f294873acb04dc88
SHA256

3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d
SHA512

94b6b6960c0b57157dc26eb6b74662d9bcea126778a2c3f9a7655448a6cb379d20a467df555f7a3a203397d6f6260bf0f0ab714aee924903a4fc32bf05ecba3a
SSDEEP

12288:gEQoSpXQJCfW5qk/j+1mU5oVhWd8pUgyy+fKA74fyBCEwgoQqEyrYxQjeTf:gwCq9i1R5WEKGaAibgnhycxQCz

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 16 IoCs

resource	yara_rule
behavioral1/memory/2756-92-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2348-93-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1628-96-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-105-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-109-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-112-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-115-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-120-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-123-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-126-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-129-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-132-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-135-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-138-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-141-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2756-144-0x0000000000400000-0x0000000000420000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 20 IoCs

resource	yara_rule
behavioral1/memory/2756-0-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/files/0x0007000000015ce1-5.dat	UPX
behavioral1/memory/2348-65-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/1628-90-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-92-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2348-93-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/1628-96-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-105-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-109-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-112-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-115-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-120-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-123-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-126-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-129-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-132-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-135-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-138-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-141-0x0000000000400000-0x0000000000420000-memory.dmp	UPX
behavioral1/memory/2756-144-0x0000000000400000-0x0000000000420000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2756-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0007000000015ce1-5.dat	upx
behavioral1/memory/2348-65-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1628-90-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-92-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2348-93-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1628-96-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-105-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-109-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-112-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-115-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-120-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-123-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-126-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-129-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-132-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-135-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-138-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-141-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2756-144-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\H:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\M:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\N:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\T:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\Y:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\A:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\B:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\Q:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\W:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\E:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\J:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\S:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\V:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\L:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\R:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\O:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\P:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\U:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\X:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\Z:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\I:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File opened (read-only)	\??\K:	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\black horse beast several models titts (Sonja,Sarah).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\config\systemprofile\blowjob catfight .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\xxx hot (!) hole 40+ (Sarah).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\config\systemprofile\russian fetish beast licking titts .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\FxsTmp\african lingerie several models 40+ .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\IME\shared\russian kicking lingerie licking titts beautyfull (Tatjana).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\lingerie sleeping glans .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\FxsTmp\russian handjob bukkake full movie hole .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\IME\shared\indian kicking blowjob public leather .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian beastiality trambling girls penetration .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\horse licking (Samantha).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\horse masturbation .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Google\Temp\gay lesbian feet young (Melissa).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\brasilian gang bang hardcore full movie (Sylvia).rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lingerie lesbian hole .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files\Common Files\Microsoft Shared\danish porn hardcore licking feet (Sonja,Samantha).avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\danish porn lingerie girls sweet .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\lingerie catfight (Janette).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\tyrkish cumshot sperm full movie .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Google\Update\Download\indian handjob lingerie [milf] YEâPSè& .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files\Windows Journal\Templates\tyrkish handjob hardcore masturbation hole .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\hardcore full movie swallow .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\trambling full movie 40+ .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\black fetish blowjob several models .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\gay public 40+ .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\Download\xxx voyeur (Samantha).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\malaysia xxx hidden feet pregnant .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_3d98a610fed70b75\handjob xxx catfight (Jade).mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\american animal lingerie voyeur cock (Sonja,Karin).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\canadian hardcore lesbian feet femdom .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\russian cum bukkake girls feet .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\fetish xxx [bangbus] (Sylvia).rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\xxx masturbation glans beautyfull (Samantha).mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\american horse horse voyeur .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\american gang bang beast sleeping glans femdom .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\cumshot blowjob [bangbus] .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\indian animal lesbian sleeping mistress .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_97a45841ff925aa0\african xxx uncut hotel .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\horse horse uncut swallow .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\russian nude lingerie uncut boots .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian beastiality lesbian hidden hole .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\nude xxx uncut titts (Britney,Curtney).mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\fucking full movie bedroom .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\african fucking licking (Sarah).rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\norwegian hardcore full movie .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\nude hardcore girls hole .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\chinese blowjob [milf] .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\black kicking fucking lesbian sweet (Britney,Liz).mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\swedish porn xxx voyeur glans high heels .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian gang bang xxx catfight swallow (Sonja,Tatjana).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\kicking trambling full movie (Sylvia).avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\nude trambling voyeur .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\porn sperm catfight cock (Sonja,Janette).mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2e7f079c3208e549\british blowjob girls titts redhair .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\xxx hot (!) .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\beast girls .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\british gay masturbation titts .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian action xxx several models titts beautyfull (Jade).mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\swedish kicking bukkake [free] titts .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\italian porn trambling girls glans swallow .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\tyrkish cum bukkake voyeur hole girly .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\brasilian handjob lingerie uncut hotel .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\spanish blowjob catfight (Curtney).mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\chinese trambling licking ejaculation .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\african gay licking feet .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\italian cum xxx hot (!) (Sarah).avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\lesbian masturbation feet hotel (Janette).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\japanese action lesbian girls granny .avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\InstallTemp\action bukkake [bangbus] titts (Jenna,Sarah).rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\sperm catfight 40+ .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\malaysia beast several models .zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\animal hardcore sleeping balls .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\italian cumshot trambling public shower .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\asian blowjob full movie (Jade).mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\beast masturbation .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\chinese lingerie uncut cock YEâPSè& .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\gang bang horse lesbian .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\brasilian beastiality horse big .mpg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\italian nude xxx girls YEâPSè& .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\danish beastiality lingerie uncut hole (Britney,Tatjana).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\bukkake full movie balls .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\tmp\black gang bang trambling girls .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\norwegian fucking public hole sm (Curtney).avi.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\kicking gay full movie boots .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\Downloaded Program Files\black cumshot sperm full movie high heels (Sandy,Janette).zip.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\danish handjob hardcore several models feet latex (Curtney).rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\american animal bukkake uncut glans ejaculation .mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\sperm big feet girly .rar.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\tyrkish cum lesbian hidden (Melissa).mpeg.exe	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
1628	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2348	2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	28
PID 2756 wrote to memory of 2348	2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	28
PID 2756 wrote to memory of 2348	2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	28
PID 2756 wrote to memory of 2348	2756	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	28
PID 2348 wrote to memory of 1628	2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	29
PID 2348 wrote to memory of 1628	2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	29
PID 2348 wrote to memory of 1628	2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	29
PID 2348 wrote to memory of 1628	2348	3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe	29

C:\Users\Admin\AppData\Local\Temp\3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
"C:\Users\Admin\AppData\Local\Temp\3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
  "C:\Users\Admin\AppData\Local\Temp\3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Users\Admin\AppData\Local\Temp\3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe
    "C:\Users\Admin\AppData\Local\Temp\3e91995f7ccfc67aceabacf02fa6a60b28fc8b800d3593c37f516c2bd609a24d.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\horse masturbation .rar.exe

Filesize
944KB

MD5
2046f43d1d7b8aa182f4589366915f67

SHA1
4979dd723c9ea05fbdee59cf1b7adc26e9632869

SHA256
83b2d942f5642db183b87e60f7093753775ab64eae1817e5bf37dbbcb6cfff38

SHA512
b27d6d565377d37dfdaa22e61fd3a3d6d24aa047fcc9d9fb914bcb53dcb313526cb781f75ae338bde9684b25f9c7d0f95ebb5b3af419a4bd82c82746e2a66e28

Download Submit
C:\debug.txt

Filesize
183B

MD5
ad79853274d2237f6a9c08928ea8f541

SHA1
3b57bdd1fdfb9d7f55a2617120679423c17c6420

SHA256
d7ff344b129d3c910ddfaeda1c7e08d60eafbad3c6b90e838694fecbfc7880be

SHA512
a1b583088eee5af7787cfba3ddd80b6067a1eaceb56174956ea9edaf92f9b1bc9af7e0ef5d8cf90dbd36f689e3c55853cbe0188a79b03021906c65369856c825

Download Submit
memory/1628-96-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1628-90-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2348-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2348-108-0x0000000004AA0000-0x0000000004AC0000-memory.dmp

Filesize
128KB

Download
memory/2348-89-0x0000000004AA0000-0x0000000004AC0000-memory.dmp

Filesize
128KB

Download
memory/2348-93-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-109-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-120-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-105-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-64-0x0000000004780000-0x00000000047A0000-memory.dmp

Filesize
128KB

Download
memory/2756-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-112-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-92-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-123-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-126-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-129-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2756-144-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download