Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 21:07
Behavioral task
behavioral1
Sample
1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe
-
Size
741KB
-
MD5
8129a90dd552d872b0f5c28352ca440f
-
SHA1
20a960cee6f1f09097b70fa6a1b78d50645a539f
-
SHA256
1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86
-
SHA512
9f0c70042bbb88d38453aecdb86ee33e0a8c6680721ea78654a5d583f9d4d2354278f3b03ed5beafee07e60e29f08c6d13e93911897da882d6982a747e3faf8b
-
SSDEEP
12288:A8EQoSMk5vbmyp03siuai5hYLVaaaKeLCdmP7I7nyjc/skq54d/TmXrv1D4cIizY:A8L5vyyp03Xbi5hYxaaaKxdq0H/z/mbs
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 17 IoCs
resource yara_rule behavioral1/memory/2472-65-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-94-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2472-103-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2868-104-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-105-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-110-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-113-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-116-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-121-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-124-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-127-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-130-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-133-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-136-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-139-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-142-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral1/memory/2400-145-0x0000000000400000-0x000000000041C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral1/memory/2400-0-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/files/0x000900000001234b-5.dat UPX behavioral1/memory/2472-65-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2868-90-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-94-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2472-103-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2868-104-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-105-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-110-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-113-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-116-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-121-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-124-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-127-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-130-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-133-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-136-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-139-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-142-0x0000000000400000-0x000000000041C000-memory.dmp UPX behavioral1/memory/2400-145-0x0000000000400000-0x000000000041C000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2400-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/files/0x000900000001234b-5.dat upx behavioral1/memory/2472-65-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2868-90-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-94-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2472-103-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2868-104-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-105-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-110-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-113-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-116-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-121-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-124-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-127-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-130-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-133-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-136-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-139-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-142-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral1/memory/2400-145-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\H: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\O: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\S: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\W: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\B: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\G: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\I: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\J: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\K: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\V: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\E: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\M: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\P: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\Q: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\R: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\U: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\X: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\Y: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\Z: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\L: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\N: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File opened (read-only) \??\T: 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\spanish kicking several models vagina fishy .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\SysWOW64\IME\shared\asian cumshot girls swallow (Anniston).mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\lingerie masturbation black hairunshaved (Kathrin,Sarah).mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\SysWOW64\IME\shared\danish fetish voyeur glans hairy .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\SysWOW64\config\systemprofile\french lesbian sperm uncut cock .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\fetish xxx [milf] gorgeoushorny .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\System32\DriverStore\Temp\american horse [milf] boobs (Britney,Liz).mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\gay horse [milf] lady .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\SysWOW64\config\systemprofile\african action licking legs upskirt .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\SysWOW64\FxsTmp\spanish gang bang fucking [bangbus] vagina penetration .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\chinese gay girls .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\xxx hardcore full movie YEâPSè& (Christine).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files\DVD Maker\Shared\horse trambling hidden ash black hairunshaved .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\handjob full movie hairy (Kathrin,Karin).mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Google\Update\Download\british blowjob uncut .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\danish lesbian trambling uncut boobs young .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\german kicking sleeping glans .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Common Files\microsoft shared\swedish animal lesbian black hairunshaved .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Google\Temp\indian fucking cum hot (!) (Sylvia).mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\african fetish hidden upskirt .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Microsoft Office\Templates\lingerie bukkake catfight nipples (Ashley,Britney).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files\Windows Journal\Templates\nude lesbian .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\sperm big .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\italian cum fetish voyeur traffic .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\trambling fetish lesbian hairy (Sylvia).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\x86_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_d8216ed3d8746200\brasilian horse handjob big .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_6.1.7600.16385_none_7f84cd98a7a56fd8\lesbian gay masturbation .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\fucking cumshot uncut boobs .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\indian porn hardcore voyeur blondie .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\cum fucking hidden boots .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_60c2504d62fd4f0e\spanish beastiality porn voyeur titts shoes (Jenna).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.1.7601.17514_none_79642285ffd2a388\german xxx nude catfight .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_6.1.7600.16385_none_a727eb798dcfb185\german trambling girls .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\sperm masturbation (Sarah,Sonja).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_6.1.7600.16385_none_965db382b6fef5cb\animal hot (!) .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3863e9ef3f804dd9\black sperm porn hidden (Anniston).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_18a6fde3093acac7\beastiality [bangbus] nipples blondie .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_6.1.7601.17514_none_4fe2107fd06efdd8\fetish fetish sleeping .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00225053e03f4c04\sperm action [free] redhair .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e30b5ec05031d17d\norwegian hardcore horse catfight boobs .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8bfc34b93f0fdd42\japanese beastiality trambling girls high heels (Janette).zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac16749b75335680\cumshot kicking [free] legs .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aea650787d30ed8a\american lingerie hidden .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bcc167434bb9b3ea\fetish licking hotel .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_6.1.7601.17514_none_34400a5790d1d336\sperm several models .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddab3bcb3a4ffb45\norwegian gang bang beast hidden YEâPSè& .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-sx-shared_31bf3856ad364e35_6.1.7600.16385_none_387a16fe7addf3b6\beast catfight titts .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_98b24799b5d08c05\lingerie handjob masturbation .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\animal bukkake sleeping .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\brasilian kicking [milf] penetration (Gina,Sylvia).zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\nude [milf] .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_16a2bb1dbab1c595\fucking masturbation .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\indian action gang bang masturbation sm .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b4aea777fe683838\indian horse sleeping vagina hotel (Britney,Sonja).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60a2cbbf935c42b4\nude gay catfight pregnant .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_6.1.7600.16385_none_99b74194b7347cab\tyrkish cumshot [milf] (Christine,Samantha).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ea4a469ab7713182\bukkake cumshot girls swallow (Jade).mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8c6fc5a7aa8c435d\norwegian horse beastiality [bangbus] (Liz).mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3772de7111797da\brasilian hardcore [free] vagina shoes (Curtney).zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2fc4a33adb648f33\beast horse licking feet .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_6.1.7601.17514_none_7bfdfb15e7184c41\horse several models .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\chinese nude [bangbus] .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\spanish lesbian voyeur (Kathrin).mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0835101f2d90c7b6\chinese animal porn licking titts .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..al-securitytemplate_31bf3856ad364e35_6.1.7600.16385_none_49dd84a06c7c8863\spanish cum handjob licking cock .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_94ab98ac6d213009\malaysia porn gay [bangbus] vagina upskirt .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\kicking fucking full movie .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\brasilian bukkake lesbian .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bacc7ceffc55dca2\porn masturbation .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_6.1.7601.17514_none_3c93ac15fd731acf\french gay [milf] blondie .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\beast sleeping .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\american bukkake horse lesbian .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\british gang bang horse lesbian glans girly (Janette).mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\temp\tyrkish gang bang [free] .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\american fucking big .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-hmeshare.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d6ada54ed6d35a2\russian gay hidden .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\animal catfight granny .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfolders-adm_31bf3856ad364e35_6.1.7600.16385_none_af6f98ff87b0e3cc\black hardcore beastiality masturbation mature .avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05ea1d9b8e2bf020\swedish cum gay hot (!) cock ejaculation (Sylvia,Ashley).avi.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\african gang bang public .mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_aedaf3947d09fbe5\gang bang masturbation sweet .zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_1412267f4b3bb985\norwegian beastiality sperm [bangbus] legs black hairunshaved .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_095efe9c8261401e\kicking [bangbus] legs (Sonja).mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_microsoft-windows-sharedfoldersui_31bf3856ad364e35_6.1.7600.16385_none_b7f38afb92de484f\cumshot fetish uncut latex .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_6.1.7600.16385_none_5e4ff1f4cf2dee9b\asian handjob big ash .mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_6.1.7600.16385_none_4d274741486b900c\russian hardcore masturbation nipples .rar.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d9f242de8497d58\bukkake kicking girls fishy (Samantha).zip.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\porn public high heels (Anniston).mpg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe File created C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6208b91f46896156\handjob kicking big penetration (Christine,Melissa).mpeg.exe 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 2868 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2472 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 28 PID 2400 wrote to memory of 2472 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 28 PID 2400 wrote to memory of 2472 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 28 PID 2400 wrote to memory of 2472 2400 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 28 PID 2472 wrote to memory of 2868 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 29 PID 2472 wrote to memory of 2868 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 29 PID 2472 wrote to memory of 2868 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 29 PID 2472 wrote to memory of 2868 2472 1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe"C:\Users\Admin\AppData\Local\Temp\1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe"C:\Users\Admin\AppData\Local\Temp\1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe"C:\Users\Admin\AppData\Local\Temp\1d5bc596f4266425e1af0b30d1c6a5cc9e3ef0a97afbda9731cfe26b6bca2d86.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2868
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5cb122888a837dac26b0d4671e2c4af95
SHA147bfcc889d1c5067f21304075b304514a08bc25c
SHA2560bec56b32ff32ca5d9f52a139a32595e78797da41a641d30736b957e10833693
SHA5129c0b9083e5b320b4939327307eb833d83ab5669a85b236221b050b539c767c0b2f84d74f92f7641997a0bc4a59803d5ad66cb0ad6c41d5fd376d894c9b970d1b
-
Filesize
183B
MD57bfdb6b128b0dc76d3e7f66fde81bf2b
SHA126ff8abd4f4808ccb132e73aa4f85e445e4019a2
SHA25641963b2131cf77bae5c88ae758ab58d704edc6fa0fbc81a2d46144c17f35dcca
SHA512bb01c1bffb7227b8c8a89ba09d1f30010593c79f76d2fb705b760b52f1125762bc095bc623e5e3061a6a2940d80d78cca0e1450f04bd9479e0c7257dae8840f4