4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
Size

1.4MB
MD5

954c3aaf6c094a32168c672ab2163c5b
SHA1

bc7e957dd5273e34d51e3a83ccdf64a335783937
SHA256

4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5
SHA512

47d7e72c8bb479a95ae088246d998bb4541df2e2374068782322c5f3b05b8415b9cb8fa13e189da95a261ff8428c14df4d94d60bb71d10f5da822bfbf8e285aa
SSDEEP

24576:A85pxgm4GZMGxGkSud3hqwXcmthAlgM8rPQD0X9Lj5JZwZhkv8XSxNf/zARUBz:Asgm4FqG7ircmthU8G4H5vwnk0XSxV/5

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 16 IoCs

resource	yara_rule
behavioral1/memory/3044-91-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2764-100-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2840-101-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-102-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-107-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-110-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-113-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-118-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-121-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-124-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-127-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-130-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-133-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-136-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-139-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/3044-142-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 20 IoCs

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/files/0x000b0000000146a2-5.dat	UPX
behavioral1/memory/2764-77-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2840-87-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-91-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2764-100-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/2840-101-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-102-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-107-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-110-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-113-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-118-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-121-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-124-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-127-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-130-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-133-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-136-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-139-0x0000000000400000-0x000000000041C000-memory.dmp	UPX
behavioral1/memory/3044-142-0x0000000000400000-0x000000000041C000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x000b0000000146a2-5.dat	upx
behavioral1/memory/2764-77-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2840-87-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-91-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2764-100-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2840-101-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-102-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-107-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-110-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-113-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-118-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-121-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-124-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-127-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-130-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-133-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-136-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-139-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3044-142-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\O:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\L:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\W:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\I:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\R:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\T:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\U:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\V:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\X:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\B:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\H:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\Y:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\G:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\K:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\M:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\N:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\P:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\Q:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\A:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\E:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\S:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File opened (read-only)	\??\Z:	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\sperm hot (!) feet mistress .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\IME\shared\gay licking mistress .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\FxsTmp\spanish lesbian masturbation mistress .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\IME\shared\indian gang bang fucking several models titts (Sonja,Melissa).zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\horse [free] .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\config\systemprofile\italian cum sperm sleeping cock .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish fetish xxx public high heels .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\FxsTmp\lingerie masturbation hole balls (Samantha).mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\config\systemprofile\indian beastiality blowjob licking femdom .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish action xxx hot (!) (Tatjana).rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\Templates\beast public .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Google\Update\Download\trambling licking hole bondage (Liz).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\blowjob hot (!) (Karin).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian handjob blowjob [free] shower .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\lingerie several models hole hairy .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian animal trambling lesbian circumcision (Sandy,Samantha).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\japanese fetish gay catfight (Tatjana).rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\russian horse lingerie full movie ìï .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\lingerie several models beautyfull .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\indian fetish lesbian licking glans ash .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Google\Temp\xxx catfight lady .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files\DVD Maker\Shared\japanese beastiality trambling licking upskirt .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\danish horse gay girls shower .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\fucking [free] 40+ .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\japanese handjob blowjob lesbian hole bondage (Melissa).rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\tyrkish nude trambling sleeping hole .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\swedish fetish trambling hidden glans beautyfull .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\russian beastiality beast voyeur cock pregnant .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\black animal lesbian hidden (Sarah).zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f25d066604c2ad34\asian lesbian big (Liz).mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\danish handjob sperm [free] (Liz).mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\fetish lingerie big .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\beast hot (!) shoes .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_c26c5b8280c6af34\danish handjob trambling full movie YEâPSè& .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\horse voyeur .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\bukkake catfight hole black hairunshaved .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\tyrkish cumshot fucking [milf] pregnant .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\lesbian big 50+ .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\german sperm girls .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\african blowjob masturbation (Sarah).mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\tyrkish porn fucking catfight wifey (Sonja,Tatjana).rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\danish fetish beast girls .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\Temp\sperm public balls .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\italian gang bang blowjob licking YEâPSè& .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\black handjob sperm licking cock hairy .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\spanish lesbian [bangbus] glans lady (Sylvia).zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\russian porn bukkake sleeping glans sweet .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\indian animal sperm [bangbus] titts black hairunshaved .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\chinese hardcore public black hairunshaved (Jenna,Jade).zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\cumshot blowjob sleeping shower .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\indian action blowjob [bangbus] titts mature (Curtney).zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\italian fetish trambling masturbation balls .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\fucking [bangbus] .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\hardcore [milf] shower (Jenna,Curtney).mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\norwegian fucking masturbation gorgeoushorny .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\italian action blowjob [free] feet ejaculation (Janette).mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\danish cum fucking [free] black hairunshaved .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\nude trambling sleeping fishy .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\bukkake hidden (Tatjana).mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\tyrkish nude bukkake hidden .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\gang bang fucking voyeur titts .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\lesbian licking feet young .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\security\templates\italian porn hardcore [milf] wifey (Jenna,Tatjana).mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\canadian xxx catfight cock .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\african lesbian [milf] glans (Jenna,Melissa).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\french lesbian [bangbus] feet 40+ (Jade).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\gang bang beast catfight feet .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\blowjob lesbian balls .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\sperm [milf] ¼ç .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\PLA\Templates\danish kicking bukkake catfight .rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black handjob trambling uncut cock .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\SoftwareDistribution\Download\tyrkish handjob lesbian licking feet (Anniston,Karin).mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\gang bang lesbian catfight .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\porn horse [free] glans .zip.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\norwegian blowjob hidden wifey .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\american fetish bukkake hidden .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\lesbian public hole .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\indian fetish sperm licking 40+ .mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\french beast hot (!) swallow .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\asian sperm [bangbus] hole .mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\indian fetish lingerie [milf] YEâPSè& .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\kicking trambling hot (!) (Karin).mpeg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\hardcore [bangbus] (Sarah).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\mssrv.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\lesbian big (Karin).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\trambling [milf] (Tatjana).rar.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\horse beast full movie lady .avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\danish porn lesbian [free] cock (Britney,Samantha).mpg.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\beastiality xxx full movie (Karin).avi.exe	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
2840	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2764	3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	28
PID 3044 wrote to memory of 2764	3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	28
PID 3044 wrote to memory of 2764	3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	28
PID 3044 wrote to memory of 2764	3044	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	28
PID 2764 wrote to memory of 2840	2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	29
PID 2764 wrote to memory of 2840	2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	29
PID 2764 wrote to memory of 2840	2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	29
PID 2764 wrote to memory of 2840	2764	4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe	29

C:\Users\Admin\AppData\Local\Temp\4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
"C:\Users\Admin\AppData\Local\Temp\4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Users\Admin\AppData\Local\Temp\4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
  "C:\Users\Admin\AppData\Local\Temp\4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe
    "C:\Users\Admin\AppData\Local\Temp\4988e88efb6a6308f762f664acc7c9ff45fcaa4bb3578a6bf159b21bc73ecdd5.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\lingerie several models beautyfull .zip.exe

Filesize
988KB

MD5
2f1ece03fa51c3177878ad402ed295fb

SHA1
50252c05f2ecb26f51d7e171605c2313a6bc7cc0

SHA256
cee61780dc1ced549bc8528a1cc909837b9973afc5fa7d149fa912c37fe1de44

SHA512
86cf25fab3c535e10878805773c740e01f485b061348fe17dccd301d1c807b4194287398bad88166440d0d088a68dd63101d14b0cc36fb5870a2e33ee65f4449

Download Submit
memory/2764-100-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-77-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-106-0x0000000004CD0000-0x0000000004CEC000-memory.dmp

Filesize
112KB

Download
memory/2764-86-0x0000000004CD0000-0x0000000004CEC000-memory.dmp

Filesize
112KB

Download
memory/2840-87-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2840-101-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-107-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-121-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-102-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-105-0x0000000004FF0000-0x000000000500C000-memory.dmp

Filesize
112KB

Download
memory/3044-76-0x0000000004FF0000-0x000000000500C000-memory.dmp

Filesize
112KB

Download
memory/3044-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-110-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-113-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-118-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-91-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-124-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-127-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-130-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-133-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-136-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3044-142-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download