Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 01:01
Behavioral task
behavioral1
Sample
a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe
- Size 850KB
- Sample240604-bdkqvsff31
- SHA256 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683
- MD5 2ac63ba91ea19cd5bc8662502404f283
- SHA1 f04c683606481a4f762aad7429be629610687f28
- SHA512 e0f4955b6c9aa7e3f3036829fb0de76b62081d09ca570c1420a898e536d56d33f66f1b84d36b9e93f4faae689bd31570008491f8c112ab6952fd037768521571
- SSDEEP 12288:VEQoSfqtG/YIja77zxCZS3DkAIEvfTMpS1DdUtQF3bA9IF1czDTCuu:VMG/Na77zOS3DkAuS1BUtybAS6E
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 18 IoCs
resource yara_rule behavioral2/memory/2144-29-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3884-152-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-179-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3884-182-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/804-181-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-184-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-185-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-191-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-205-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-210-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-214-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-218-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-222-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-226-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-230-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-234-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-238-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/3824-242-0x0000000000400000-0x000000000041E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames - UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral2/memory/3824-0-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/files/0x0008000000023433-5.dat UPX behavioral2/memory/2144-29-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3884-152-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-179-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3884-182-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/804-181-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-184-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-185-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-191-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-205-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-210-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-214-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-218-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-222-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-226-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-230-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-234-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-238-0x0000000000400000-0x000000000041E000-memory.dmp UPX behavioral2/memory/3824-242-0x0000000000400000-0x000000000041E000-memory.dmp UPX - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3824-0-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/files/0x0008000000023433-5.dat upx behavioral2/memory/2144-29-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3884-152-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-179-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3884-182-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/804-181-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-184-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-185-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-191-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-205-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-210-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-214-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-218-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-222-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-226-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-230-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-234-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-238-0x0000000000400000-0x000000000041E000-memory.dmp upx behavioral2/memory/3824-242-0x0000000000400000-0x000000000041E000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\B: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\E: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\G: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\H: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\K: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\L: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\Z: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\A: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\N: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\P: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\U: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\W: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\Y: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\V: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\X: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\I: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\J: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\M: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\O: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\Q: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\R: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File opened (read-only) \??\S: a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\FxsTmp\american porn big beautyfull .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\IME\SHARED\spanish horse sleeping .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\norwegian nude masturbation bedroom .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\FxsTmp\horse animal public .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\IME\SHARED\indian fucking lesbian catfight bedroom .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\black cum beastiality voyeur stockings .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\spanish sperm full movie vagina high heels (Janette).mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\config\systemprofile\german nude beastiality masturbation .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\config\systemprofile\indian trambling several models fishy .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\System32\DriverStore\Temp\african sperm gang bang lesbian girly .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\action gang bang full movie nipples shower .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\nude [milf] .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe - Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Shared Gadgets\italian sperm lesbian several models titts .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\malaysia cum lesbian full movie sm .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Google\Temp\malaysia handjob sperm uncut .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\danish cumshot sperm masturbation boobs (Tatjana,Kathrin).zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\norwegian hardcore [free] hole traffic .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\norwegian beast public .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\german lingerie bukkake sleeping legs 40+ .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Microsoft\Temp\animal hot (!) castration .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Google\Update\Download\malaysia horse animal [bangbus] vagina .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\danish cumshot uncut legs ash .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\dotnet\shared\african xxx cum girls boots (Melissa).rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black fetish lingerie big beautyfull .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\trambling licking (Sonja,Britney).zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\black sperm horse several models hole leather (Sylvia).zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\Common Files\microsoft shared\japanese lingerie cumshot several models feet boots .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\Microsoft Office\root\Templates\asian animal masturbation legs boots .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\french nude several models mature .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Program Files\Microsoft Office\Updates\Download\lesbian fetish licking ash .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\fetish gay lesbian ejaculation .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89c0bf1761110f07\nude action big sweet .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\african fucking cumshot masturbation sm (Sonja,Christine).mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\porn catfight (Britney,Kathrin).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\animal lesbian legs upskirt .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\fucking trambling uncut sm .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_91025638be651781\xxx licking (Jenna).mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\x86_microsoft.grouppolicy.admtmpleditor_31bf3856ad364e35_10.0.19041.1_none_34e3bab50607a64b\blowjob [milf] young .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\spanish lingerie sleeping hole castration .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd7349c396c417ae\gay lesbian [milf] cock (Christine).rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\african trambling fetish [bangbus] shoes (Sonja,Sonja).mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\action catfight (Jade,Kathrin).mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\horse sleeping boobs .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\african beast catfight (Tatjana).rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..se-shared-datafiles_31bf3856ad364e35_10.0.19041.1_none_2f5f00d280dce9f6\malaysia gay sleeping 50+ .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devdispitemprovider_31bf3856ad364e35_10.0.19041.867_none_c29826784f9429f8\animal cumshot licking black hairunshaved .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\russian fucking licking hole young (Sarah,Kathrin).mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_0341fea186758116\porn voyeur bondage .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.1_none_f3b35d713ce0fc7f\brasilian sperm hot (!) beautyfull .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_57eddd48e7a74274\indian gay gang bang big feet (Gina).mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\chinese nude voyeur .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_es-es_bf79b5fcc06b3128\horse nude several models leather .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\black sperm horse licking .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\action [bangbus] wifey (Sarah,Christine).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\kicking uncut blondie .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_c494b3b28da10665\chinese action cumshot sleeping wifey .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\black handjob xxx full movie traffic (Jade,Sandy).mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\cum [bangbus] .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_bfae5918c0443f83\malaysia lesbian horse uncut cock (Britney,Sarah).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\porn several models redhair .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_6115038ba57fcb33\asian gang bang nude [milf] nipples .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\norwegian gang bang voyeur .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\british sperm cum licking balls .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\chinese fetish hardcore lesbian pregnant .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\japanese beast trambling catfight .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\porn full movie circumcision .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_installsqlstatetemp_b03f5f7f11d50a3a_10.0.19041.1_none_03040a328f65b761\beastiality xxx public traffic .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_10.0.19041.1_none_77cfea69a421a4a1\danish blowjob hot (!) cock castration .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\sperm [bangbus] mistress .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\danish beast porn several models circumcision .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\horse porn full movie cock .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\action [bangbus] ejaculation .rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_d9e58b774d1b6e80\canadian beast full movie femdom .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\assembly\tmp\italian cum [milf] shower .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\african beast hidden (Melissa).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\german hardcore trambling [milf] black hairunshaved .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\indian nude [free] young (Christine).mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.1_none_2fe79eae2833b9b1\lesbian sleeping hotel .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\lesbian public .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\fetish handjob licking (Sonja,Sonja).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\trambling bukkake sleeping cock bedroom .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\malaysia fucking gang bang [milf] hole high heels (Jade).rar.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\african beastiality licking .avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_72a319bf8ee74a9b\kicking hardcore hidden (Janette).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\gay cumshot [free] glans bondage .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\norwegian lingerie voyeur ash .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.1_none_f42978969c79336a\brasilian horse public bondage .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\porn several models legs .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\british beastiality horse [bangbus] nipples traffic (Sarah,Britney).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\italian trambling several models (Britney,Sonja).zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\spanish trambling fetish [milf] fishy .mpeg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_f8e978b0ed48a6bb\beastiality lesbian [free] (Tatjana,Liz).avi.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1_none_0b596e2a33be7d4c\black trambling hidden .zip.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\animal blowjob [bangbus] feet penetration .mpg.exe a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 3884 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 804 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3824 wrote to memory of 2144 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 84 PID 3824 wrote to memory of 2144 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 84 PID 3824 wrote to memory of 2144 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 84 PID 3824 wrote to memory of 804 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 87 PID 3824 wrote to memory of 804 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 87 PID 3824 wrote to memory of 804 3824 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 87 PID 2144 wrote to memory of 3884 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 88 PID 2144 wrote to memory of 3884 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 88 PID 2144 wrote to memory of 3884 2144 a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3884
-
-
-
C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"C:\Users\Admin\AppData\Local\Temp\a2ad542f8f86117e5fc8e344d2a6644eb22cb3973e7f8145a217e76f8c197683.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black fetish lingerie big beautyfull .rar.exe
- Size 1.8MB
- SHA256 20a5fe08f792eed176f0ac4cae366fc4e308aa8ac58d2b868215dafa55613612
- MD5 53f7e1144d6654d128a4ff855635d7d2
- SHA1 75302bc41fe8729dad756909e9b7344ff0ebcd52
- SHA512 1ac5e3903605a286f89446edc07729941e9f66e9d0019e0e30ae98792ee7362eaa4e2293be5204355995fd1619fcac31023c62b2405f3f12265fcb2d843713db
- SSDEEP 24576:VojP14b8uCwdJM1ZVNfsxijB9CGbEr3MUXhtpCi3GX+Ze67k6S+4wGUBj8TL8IR4:O88GMX6i2r39vEX+ZVk44pYIC
- MD5 SHA1 SHA512 SSDEEP