Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:43
Behavioral task
behavioral1
Sample
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe
Resource
win10v2004-20240426-en
General
-
Target
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe
-
Size
85KB
-
MD5
134596320e44e8104d21202c88393916
-
SHA1
ea9ef117d0b3e20c246802b04a33ae33ab9631fc
-
SHA256
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f
-
SHA512
44b185307e4749ffc0e16afc141bf9e2b74061316f87d3a7a60670e565524f836860622f16e4a22dd489f6140f7eba6ed3518b0d3e602a6b5470b62f4dbc7470
-
SSDEEP
1536:/RVCaKgzbLc54hukfgvqnDFdorV1Ayj4m/QWR/Rlq88vlnRqPR/1aViDRknJM2S8:JjbLl/gvyDFep1Tj4mYWR/R4nkPR/1aN
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 21 IoCs
Processes:
resource yara_rule behavioral2/memory/2500-54-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3956-155-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2664-156-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-183-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2500-184-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2664-186-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3956-185-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-188-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-189-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-195-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-205-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-209-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-214-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-218-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-222-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-226-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-230-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-234-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-238-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-242-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1760-246-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 23 IoCs
Processes:
resource yara_rule behavioral2/memory/1760-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\british nude kicking voyeur .avi.exe UPX behavioral2/memory/2500-54-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3956-155-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2664-156-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-183-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2500-184-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/2664-186-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3956-185-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-188-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-189-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-195-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-205-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-209-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-214-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-218-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-222-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-226-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-230-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-234-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-238-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-242-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/1760-246-0x0000000000400000-0x000000000041E000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1760-0-0x0000000000400000-0x000000000041E000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\british nude kicking voyeur .avi.exe upx behavioral2/memory/2500-54-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3956-155-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2664-156-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-183-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2500-184-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/2664-186-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3956-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-188-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-189-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-195-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-205-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-209-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-214-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-218-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-222-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-226-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-230-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-234-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-238-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-242-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/1760-246-0x0000000000400000-0x000000000041E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exedescription ioc process File opened (read-only) \??\Y: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\B: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\M: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\S: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\U: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\V: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\G: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\I: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\K: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\N: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\X: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\A: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\H: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\P: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\Q: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\T: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\W: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\Z: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\E: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\J: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\L: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\O: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File opened (read-only) \??\R: 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe -
Drops file in System32 directory 12 IoCs
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exedescription ioc process File created C:\Windows\SysWOW64\FxsTmp\spanish cumshot several models circumcision .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\IME\SHARED\beast trambling masturbation .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\norwegian handjob lingerie several models hole redhair .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\danish handjob several models vagina .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\bukkake licking (Sylvia).mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\handjob lingerie licking .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\config\systemprofile\horse fetish hot (!) balls .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\FxsTmp\spanish gang bang gang bang hidden boobs .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\config\systemprofile\norwegian fucking porn sleeping cock .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\System32\DriverStore\Temp\handjob sperm hot (!) gorgeoushorny .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SysWOW64\IME\SHARED\indian trambling lingerie full movie (Sandy,Sarah).rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\african gay handjob public high heels (Tatjana).zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe -
Drops file in Program Files directory 18 IoCs
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Temp\trambling lesbian boots (Tatjana).zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Microsoft Office\root\Templates\brasilian beastiality licking femdom .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\british nude kicking voyeur .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files (x86)\Google\Temp\chinese fetish voyeur .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\nude uncut shoes .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Microsoft Office\Updates\Download\chinese horse fucking licking glans black hairunshaved .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\french kicking uncut shoes .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\brasilian blowjob voyeur latex .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\norwegian gang bang [milf] boobs castration .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\dotnet\shared\norwegian handjob horse big .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beast voyeur wifey (Janette,Anniston).zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\fetish sperm several models .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\asian nude action [bangbus] gorgeoushorny .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\trambling lesbian penetration .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Common Files\microsoft shared\nude action catfight Ôï .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\fetish lesbian voyeur (Karin).mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\indian horse horse hot (!) granny (Anniston,Curtney).mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Program Files (x86)\Google\Update\Download\cumshot lesbian .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe -
Drops file in Windows directory 64 IoCs
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exedescription ioc process File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\asian lingerie trambling voyeur .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\indian fetish hot (!) high heels .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\brasilian cumshot catfight sweet .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\chinese kicking catfight .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\trambling beast voyeur black hairunshaved .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\horse horse several models circumcision .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\lesbian voyeur black hairunshaved (Liz,Curtney).rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_5d54c0aac5c3c12c\horse trambling full movie ash pregnant .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\indian cum [milf] stockings .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\african sperm sleeping ash beautyfull (Sandy).rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_6c6bd34f082a97f1\japanese hardcore lesbian hidden .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\african trambling sleeping traffic .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\malaysia trambling fetish full movie hairy .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\gay big mistress (Jenna).zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\kicking [milf] hairy (Gina).avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\american nude porn voyeur .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_3a3c49005c947bac\brasilian cumshot masturbation sweet (Gina,Christine).avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\canadian action hot (!) latex .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\gay horse sleeping .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.1_none_9aa486d790131d4e\horse handjob catfight .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\canadian fucking beastiality [free] .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\swedish kicking kicking [milf] .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\indian cum action girls gorgeoushorny .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\spanish horse hot (!) (Sandy,Janette).avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\malaysia hardcore horse masturbation mature .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm_31bf3856ad364e35_10.0.19041.1_none_ae957c4c35a7bf73\french hardcore bukkake licking 50+ (Sandy).rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\chinese sperm big .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_a23e6a858fad9595\asian animal full movie .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\hardcore public nipples shoes (Britney).rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1_none_97e9c0335b4cd39a\italian xxx catfight sweet (Janette).mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\brasilian animal beastiality hot (!) .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\american fetish gang bang uncut cock black hairunshaved .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\italian handjob hardcore girls cock hairy .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\german lesbian horse public (Janette).mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-sharedcomponents_b03f5f7f11d50a3a_4.0.19041.1_none_47ca94859da20b28\sperm lingerie sleeping penetration (Christine,Curtney).mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\american horse uncut femdom .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\nude licking castration (Ashley,Jenna).mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_de598551b74a3964\british lingerie sleeping cock pregnant .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\InputMethod\SHARED\cumshot beast public balls .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\american cumshot sperm masturbation pregnant .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\japanese cum girls cock circumcision .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\beast lingerie [free] shower .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\trambling lingerie lesbian wifey .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\chinese hardcore licking young .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\canadian cumshot catfight Ôï .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\american hardcore fetish full movie .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\Temp\bukkake catfight .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\handjob horse catfight gorgeoushorny .zip.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\sperm [milf] pregnant .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\tyrkish beast several models ash beautyfull (Sandy).mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_it-it_56adcc94becfef03\xxx voyeur high heels (Christine).mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\danish fucking [bangbus] bondage (Sylvia,Sarah).rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\nude beast sleeping beautyfull .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_8fafa997b9980bea\cum horse girls .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\nude gay [milf] redhair .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\gay hot (!) .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\tyrkish nude lesbian .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\black fucking gay uncut blondie .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\sperm girls legs shower .avi.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6c85d64de79e0985\animal sleeping granny .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\x86_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_231ddfc33015c6db\danish lesbian [bangbus] redhair .mpeg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\cum beast masturbation vagina .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\horse lesbian several models .mpg.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\danish sperm horse big vagina .rar.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exepid process 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2664 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 3956 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exedescription pid process target process PID 1760 wrote to memory of 2500 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 1760 wrote to memory of 2500 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 1760 wrote to memory of 2500 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 1760 wrote to memory of 3956 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 1760 wrote to memory of 3956 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 1760 wrote to memory of 3956 1760 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 2500 wrote to memory of 2664 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 2500 wrote to memory of 2664 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe PID 2500 wrote to memory of 2664 2500 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe 81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"C:\Users\Admin\AppData\Local\Temp\81621a043eda965a444fc2e71eccb99fd9377230b4edfa8d364a2ee0c30f2c6f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\british nude kicking voyeur .avi.exeFilesize
1.4MB
MD5dcb613f3b37ec90dd484526d56840e5f
SHA1fa92dfab3fa6830b2dc7fb53476eaab4afd2c50d
SHA256f533bfa3a3317afdc4568cbf6af9194c7667242e746a110c77179c4de036eaf7
SHA512f1c76c89de5e2ebf53bd7a0ea8cd5ed200dd742b0fa64c6b9900d2cc074aad37ddaa7e5d35ed198251a8cf31c775457949d4d9a24caa9a522cc5bb1f8a5cbee3
-
memory/1760-189-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-214-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-205-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-195-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-183-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-230-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-226-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-242-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-209-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-0-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-246-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-238-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-188-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-234-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-218-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1760-222-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2500-54-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2500-184-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2664-186-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2664-156-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3956-155-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3956-185-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB