68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0

Analysis

max time kernel
140s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
Size

1.7MB
MD5

e73d35d434affe7942adf41d409596f2
SHA1

3ddb5076cd1b31842ed66f033c054b0727c85c62
SHA256

68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0
SHA512

1e6ba569311419009b8075996e0802a2f4a7bd2df418dbedaf7fd86712908c733a778cc0fc9eabb213c747fcccc97c9a0397491feb147cf360677f676a9ea880
SSDEEP

49152:P19f89b3VTF1+PU67T/lVi0SwJ8SVvPjUT3K:d9fWRhYPnT/lVs9Ywe

Score

9^/10

persistence spyware stealer upx

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 19 IoCs

resource	yara_rule
behavioral1/memory/2596-51-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-88-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2352-89-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2596-90-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/2560-91-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-92-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-93-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-98-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-103-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-109-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-121-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-125-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-129-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-135-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-139-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-143-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-147-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-151-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames
behavioral1/memory/1612-155-0x0000000000400000-0x000000000041E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

UPX dump on OEP (original entry point) 22 IoCs

resource	yara_rule
behavioral1/memory/1612-0-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2352-5-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/files/0x0007000000014a55-7.dat	UPX
behavioral1/memory/2596-51-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-88-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2352-89-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2596-90-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/2560-91-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-92-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-93-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-98-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-103-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-109-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-121-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-125-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-129-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-135-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-139-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-143-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-147-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-151-0x0000000000400000-0x000000000041E000-memory.dmp	UPX
behavioral1/memory/1612-155-0x0000000000400000-0x000000000041E000-memory.dmp	UPX

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1612-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2352-5-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0007000000014a55-7.dat	upx
behavioral1/memory/2596-51-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-88-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2352-89-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2596-90-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2560-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-92-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-93-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-98-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-103-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-109-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-121-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-125-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-129-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-135-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-139-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-143-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-147-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-151-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1612-155-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\P:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\U:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\B:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\G:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\I:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\Q:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\T:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\W:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\X:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\Z:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\A:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\H:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\J:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\L:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\M:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\N:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\R:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\Y:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\K:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\O:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\S:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File opened (read-only)	\??\V:	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\LogFiles\Fax\Incoming\brasilian fucking [free] .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\FxsTmp\sperm voyeur penetration .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\IME\shared\russian kicking [free] balls (Jenna).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\handjob big vagina .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\FxsTmp\british sperm trambling sleeping ash .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\IME\shared\gay action big .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\german gang bang hidden hole wifey .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\norwegian horse big .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\beastiality gay voyeur hole mistress (Gina).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\System32\DriverStore\Temp\german beast [bangbus] feet .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\fucking gay uncut YEâPSè& (Gina).zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\swedish handjob [free] boobs blondie .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\handjob beastiality voyeur 40+ .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\brasilian fetish public sweet .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files\DVD Maker\Shared\german beast beastiality masturbation shoes .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Google\Update\Download\xxx girls nipples (Curtney,Kathrin).zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\xxx cum [bangbus] hole (Karin,Ashley).mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\cumshot gay full movie ash leather .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files\Windows Journal\Templates\norwegian animal sperm uncut (Sarah).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\swedish cumshot [bangbus] feet black hairunshaved .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\indian horse uncut penetration .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\gang bang sleeping feet bondage .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\tyrkish fetish horse [milf] cock (Sylvia,Jade).mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Google\Temp\german gay hidden glans .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\horse fucking masturbation ash .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\beast gang bang [bangbus] pregnant .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared_31bf3856ad364e35_6.1.7600.16385_none_6377027f0030a06a\xxx sleeping .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\american cumshot sleeping sm .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\blowjob porn uncut boobs bedroom .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\animal horse licking .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\chinese porn sleeping legs YEâPSè& .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\french lingerie lesbian swallow .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\indian hardcore masturbation .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ad7c61fb28607522\xxx hidden ash redhair (Sarah,Britney).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\kicking hidden (Karin).zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\Temp\cumshot lesbian public vagina .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\hardcore fetish several models stockings .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\chinese lesbian uncut (Ashley).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\japanese bukkake big .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_6.1.7601.17514_none_dd18b2a07d49aa11\chinese kicking [milf] nipples shoes .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_netfx-shared_registry_whidbey_31bf3856ad364e35_6.1.7600.16385_none_664dbffec8693dfe\italian lesbian [milf] ìï .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\norwegian gang bang sperm masturbation .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\blowjob lingerie full movie (Janette,Sandy).rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\cumshot [bangbus] boobs .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_6f0f7833cb71e18d\tyrkish animal public black hairunshaved .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_963e6ae24c653bfe\swedish action [milf] glans castration .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\SoftwareDistribution\Download\black porn big black hairunshaved .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_94828572f7ddbf0f\beastiality uncut cock bondage .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\african gang bang lesbian big titts (Sonja).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00f45b041e1e8fd3\action hardcore [milf] (Karin).avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\swedish gay action several models boots (Janette,Liz).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0993a1b8823a4e79\sperm xxx public stockings (Sonja,Britney).mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\horse gang bang full movie (Karin).zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65b23d3c3a97bfaf\fucking hardcore several models 40+ .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\chinese trambling horse masturbation .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_a945e2c500c90142\italian gay sleeping .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\trambling several models shower .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5d9f7d70ed4643fd\chinese porn trambling [free] femdom .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_6.1.7600.16385_none_5499606faffb3f9f\american gang bang blowjob voyeur feet .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_39c9d74ef2ad6c7b\tyrkish kicking catfight traffic (Sandy,Tatjana).rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\InstallTemp\spanish gang bang big boots .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\handjob kicking sleeping .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\american beastiality [bangbus] feet .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\sperm horse hidden girly .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\danish lesbian lesbian mistress .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\cumshot sperm full movie nipples sm (Samantha).mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_f27c4f066f5c6701\swedish gang bang lesbian 50+ .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5803850b2f40840e\action hot (!) boobs .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\canadian kicking big .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\assembly\temp\chinese horse bukkake [free] titts leather .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\asian horse porn masturbation blondie .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\malaysia hardcore hot (!) balls .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_f3c374fc18118ca2\italian sperm hot (!) vagina ash .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\malaysia beast masturbation blondie .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_es-es_00bfb7e81e458178\brasilian blowjob masturbation redhair .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\handjob sleeping .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\lingerie kicking full movie legs lady .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\swedish trambling beast licking black hairunshaved .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\canadian fucking trambling [free] cock girly .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\spanish lingerie lesbian masturbation .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\PLA\Templates\norwegian beast hidden redhair .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\fucking several models .mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\fetish beastiality big boobs .avi.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\british gang bang catfight 40+ .rar.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\mssrv.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\animal hidden .zip.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\Downloaded Program Files\indian xxx catfight shower (Sonja).mpeg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_d81c96999f75bd77\fucking fetish public feet (Ashley,Karin).mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_9498b282333b64ec\gang bang nude sleeping feet blondie .mpg.exe	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2560	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
2596	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2352	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	28
PID 1612 wrote to memory of 2352	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	28
PID 1612 wrote to memory of 2352	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	28
PID 1612 wrote to memory of 2352	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	28
PID 2352 wrote to memory of 2596	2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	29
PID 2352 wrote to memory of 2596	2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	29
PID 2352 wrote to memory of 2596	2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	29
PID 2352 wrote to memory of 2596	2352	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	29
PID 1612 wrote to memory of 2560	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	30
PID 1612 wrote to memory of 2560	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	30
PID 1612 wrote to memory of 2560	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	30
PID 1612 wrote to memory of 2560	1612	68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe	30

C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
"C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
  "C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
    "C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
- C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe
  "C:\Users\Admin\AppData\Local\Temp\68f56f80ce336a4a1dff403854bf2a5fe16348b34860e4560775041849a565f0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\swedish cumshot [bangbus] feet black hairunshaved .mpeg.exe

Filesize
1.5MB

MD5
9489e93da8849c373651c2c1e609b5a7

SHA1
5e781e1d0c227886ed8cbb20c35c2dc2ecf04364

SHA256
8eb226330d37537c242b66371c78295307f2669f5f8d020d298a41db4522c91b

SHA512
51f84d05680788780334ad46e5395a53f5a73e4b5108d805ed42c1108cc5a79a69304eb7e7e09eb0491075470bd1c4c9c9b6c96abd2ba1702e18a993e38ed3a8

Download Submit
C:\debug.txt

Filesize
183B

MD5
8c589ff98592516babcce8a534f0124a

SHA1
e801bfc5b7ee9e909d14384c40e02b4c03cf3664

SHA256
3b2afd66aca74f3512076297230572ed2a04962e43361bce1fb781c7086ebe98

SHA512
9db1f2f2a43a5041ab5142fa82bcc88eed111d241c172dfba74b818f38bd0819300ab2c5f86d31d80ee406dc40405eb76b04b6d38dab4aac68cd0d0d237641a6

Download Submit
memory/1612-94-0x00000000048C0000-0x00000000048DE000-memory.dmp

Filesize
120KB

Download
memory/1612-103-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-155-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-151-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-88-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-147-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-98-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-143-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-92-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-93-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-139-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-125-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-109-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-4-0x00000000048C0000-0x00000000048DE000-memory.dmp

Filesize
120KB

Download
memory/1612-121-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1612-129-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2352-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2352-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2352-50-0x0000000004A40000-0x0000000004A5E000-memory.dmp

Filesize
120KB

Download
memory/2560-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-90-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2596-51-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download