Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 01:39
Behavioral task
behavioral1
Sample
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe
Resource
win10v2004-20240226-en
General
-
Target
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe
-
Size
674KB
-
MD5
66d399a25afa81e7e00773b0bd7f5ffa
-
SHA1
d81129912c23d461d1644eb8a3b0cfad6d4bb30c
-
SHA256
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb
-
SHA512
b27013de1c07bdd81cb1bd3617b6f7ccfd3d82fe94687456a55d9370b44cc7c6c614aa40344d4d85c2fd795e3d571771ee2610985ed91567c3c1f930143d75d9
-
SSDEEP
12288:VEQoSmyv4iAfeomJ+VURrVfH4gMBAmbBeu2rXjevNcRze2LFDewBMI35Apea:VVh0CJ+VEBPOBAm9grXjevNoeseAApea
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1596-14-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1432-21-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1780-24-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2592-26-0x0000000000400000-0x000000000041F000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
Processes:
resource yara_rule behavioral2/memory/1596-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/files/0x0007000000023275-5.dat UPX behavioral2/memory/1432-11-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1780-12-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/2592-13-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1596-14-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1432-21-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/1780-24-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/2592-26-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exeb026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1596-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x0007000000023275-5.dat upx behavioral2/memory/1432-11-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1780-12-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2592-13-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1596-14-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1432-21-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1780-24-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2592-26-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exedescription ioc Process File opened (read-only) \??\E: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\N: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\V: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\W: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\A: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\G: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\H: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\J: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\O: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\S: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\T: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\K: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\L: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\M: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\R: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\Y: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\Z: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\B: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\I: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\P: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\Q: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\U: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File opened (read-only) \??\X: b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe -
Drops file in System32 directory 12 IoCs
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exedescription ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\cum xxx several models feet granny .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\cum voyeur .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\IME\SHARED\beast hot (!) (Janette).mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\porn full movie (Sarah).zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\config\systemprofile\cum [free] (Sandy,Anniston).avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\FxsTmp\swedish gang bang gay lesbian feet sm .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\IME\SHARED\german lingerie trambling hot (!) .zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\FxsTmp\action horse voyeur vagina latex .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\french porn hardcore full movie vagina .mpeg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\System32\DriverStore\Temp\gang bang gay public .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\asian horse cumshot masturbation nipples .zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SysWOW64\config\systemprofile\japanese horse uncut .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe -
Drops file in Program Files directory 19 IoCs
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exedescription ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\norwegian action licking .mpeg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Google\Temp\nude xxx uncut glans .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\dotnet\shared\chinese bukkake public mature .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Microsoft Office\root\Templates\malaysia blowjob kicking catfight sweet .zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian horse public shower .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\asian action hot (!) vagina .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\french kicking hidden .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Microsoft Office\Updates\Download\danish fucking girls 50+ .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\indian cumshot bukkake catfight wifey .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\norwegian gay uncut YEâPSè& .mpeg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Common Files\microsoft shared\swedish xxx [milf] .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\porn sperm public wifey .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\fetish xxx uncut legs Ôï .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fucking blowjob [free] high heels (Samantha,Jenna).zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\asian cumshot big nipples (Curtney).mpeg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Microsoft\Temp\french gay horse voyeur glans redhair (Britney).mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\norwegian xxx lesbian hairy .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\swedish xxx gay licking (Tatjana).rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Program Files (x86)\Google\Update\Download\handjob [bangbus] sweet .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe -
Drops file in Windows directory 28 IoCs
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exedescription ioc Process File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\indian blowjob masturbation ash fishy .zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\assembly\tmp\tyrkish cum masturbation hairy (Karin,Sandy).zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\CbsTemp\indian nude cum voyeur hotel (Gina).avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\PLA\Templates\american kicking several models legs pregnant .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\security\templates\american gang bang gay masturbation (Jenna).zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\fetish handjob masturbation .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\beast horse big pregnant (Sonja).zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\InputMethod\SHARED\german hardcore xxx full movie sm .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\canadian gang bang beast [milf] latex .mpeg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\french sperm trambling licking 50+ (Sonja,Jade).mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\cumshot cum [bangbus] .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\black horse licking .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\norwegian sperm gang bang masturbation feet (Jade,Sonja).zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\Downloaded Program Files\italian animal girls nipples young .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\blowjob voyeur YEâPSè& .zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\swedish gang bang beast lesbian lady .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\cumshot lesbian (Gina,Ashley).mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\beastiality trambling [bangbus] .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\nude hidden nipples gorgeoushorny .rar.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\assembly\temp\spanish kicking catfight nipples penetration (Kathrin).mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\danish beast gay hot (!) redhair .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\indian lingerie sperm voyeur ejaculation .zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\french beastiality [milf] penetration (Sonja,Curtney).zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\indian animal action sleeping titts boots .zip.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\SoftwareDistribution\Download\beastiality nude several models titts balls .avi.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\mssrv.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\french horse [milf] titts (Tatjana).mpeg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\beastiality beastiality big cock circumcision .mpg.exe b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exeb026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exeb026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exeb026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exepid Process 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 2592 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 1780 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exeb026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exedescription pid Process procid_target PID 1596 wrote to memory of 1432 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 89 PID 1596 wrote to memory of 1432 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 89 PID 1596 wrote to memory of 1432 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 89 PID 1596 wrote to memory of 1780 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 90 PID 1596 wrote to memory of 1780 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 90 PID 1596 wrote to memory of 1780 1596 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 90 PID 1432 wrote to memory of 2592 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 91 PID 1432 wrote to memory of 2592 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 91 PID 1432 wrote to memory of 2592 1432 b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2592
-
-
-
C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"C:\Users\Admin\AppData\Local\Temp\b026085d9766cd27a06db958f10cd7d1084ddb235b377b235797b47c5be2e1fb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:81⤵PID:404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\porn sperm public wifey .avi.exe
Filesize411KB
MD589ca8124bdedfe3e37c0f57fa24a44ec
SHA195cd004209f978e7cb0e760ddb42128b88775466
SHA256e932669e54f3d68b546ba7d9fa0ae79fde36ca7b1b80cb238815d2a3a5b02329
SHA512c05fff6eb25d37fd2b1682467d29efff074954ea81bb46ffa38259f87b485de0a9c63d2fce77c113791330b466702cd2fed6eb7cdc9608ae7f5d6a6cc0662945