Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 02:31
Static task
static1
Behavioral task
behavioral1
Sample
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe
Resource
win10v2004-20240611-en
General
-
Target
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe
-
Size
1.8MB
-
MD5
7bd7c51d8f8045a7e4c1d95ad3b62b6d
-
SHA1
ab54d5e32afa60cc4902440163018fff8d1f6b22
-
SHA256
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8
-
SHA512
32b04b53a9f1f7ad76a4f6a6aea26e61da638f910ad8c86ce716a5ac8b4c23c7cde0918d5d2c15395e629849667544c286ac7391dc365c199a0e397380d724db
-
SSDEEP
49152:VJ23vbocK7x8rtNSPHq4RBh3B1OcFOTcNxKoM:vSbFK0NmXBh3n+doM
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 1 IoCs
Processes:
resource yara_rule C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\spanish nude beastiality lesbian nipples swallow .rar.exe INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exeabf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exedescription ioc process File opened (read-only) \??\I: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\J: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\N: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\Q: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\S: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\V: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\A: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\H: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\K: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\L: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\P: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\T: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\Z: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\B: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\E: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\G: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\O: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\R: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\W: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\X: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\M: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\U: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File opened (read-only) \??\Y: abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe -
Drops file in System32 directory 12 IoCs
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exedescription ioc process File created C:\Windows\System32\DriverStore\Temp\brasilian kicking uncut balls (Jade,Ashley).avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\malaysia handjob voyeur hole swallow .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\french sperm hardcore uncut .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\lesbian full movie feet leather .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\FxsTmp\brasilian nude hot (!) ash .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\config\systemprofile\italian horse big .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\IME\SHARED\blowjob several models ash blondie (Tatjana).avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\config\systemprofile\beastiality lingerie uncut glans hairy .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\IME\SHARED\italian porn lingerie full movie .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\spanish handjob bukkake uncut .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\lesbian [bangbus] girly (Britney,Jenna).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SysWOW64\FxsTmp\porn bukkake girls .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe -
Drops file in Program Files directory 20 IoCs
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exedescription ioc process File created C:\Program Files (x86)\Common Files\Microsoft Shared\sperm horse uncut cock 50+ (Britney).rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Google\Update\Download\african horse girls cock .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\spanish nude beastiality lesbian nipples swallow .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\sperm licking hairy .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Microsoft Office\Updates\Download\indian lesbian xxx [free] shoes .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\african gay horse voyeur ejaculation (Jade).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\fetish public .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\dotnet\shared\indian horse nude hot (!) (Janette).mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american trambling licking cock boots .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\indian xxx sleeping ash (Jade).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Microsoft\Temp\animal trambling [free] glans beautyfull (Liz).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Microsoft\Temp\EU8B19.tmp\indian trambling big .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\german bukkake beast sleeping boots .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Common Files\microsoft shared\canadian gang bang action uncut sm .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Microsoft Office\root\Templates\handjob lingerie several models upskirt .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\sperm masturbation vagina .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\beastiality xxx several models cock ash (Liz).avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{012F12C5-F267-46F5-BABE-4C602515640C}\EDGEMITMP_0327D.tmp\african xxx uncut girly (Sylvia,Ashley).zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\black trambling kicking hidden swallow (Christine).rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Program Files (x86)\Google\Temp\porn cum big boobs Ôï (Sonja).rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe -
Drops file in Windows directory 64 IoCs
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exedescription ioc process File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish lesbian [bangbus] hole lady .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_e79b400a6df5fd2c\bukkake cum [milf] legs .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_e5c3ad79c4e34ebb\japanese gang bang porn catfight high heels .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\chinese horse nude [free] redhair .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.1_none_abfc9db6c377b91f\american lesbian [free] (Sarah).avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_it-it_1a80ce63d483fe70\gay cum sleeping glans .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\nude big ash lady .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\trambling horse hot (!) boobs .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\malaysia xxx lesbian girls hole .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\fetish lesbian sweet (Gina,Britney).zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\beast nude lesbian balls .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataoraclec.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_3b8d4dacc2ea6b71\indian horse xxx sleeping boobs .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\Temp\cumshot masturbation vagina stockings .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\porn lesbian (Sylvia,Samantha).avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedrealitysvc_31bf3856ad364e35_10.0.19041.746_none_822bf1ada1526fa8\nude beastiality licking (Curtney,Janette).rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ell-sharedutilities_31bf3856ad364e35_10.0.19041.1_none_813610a8a9b59e0a\spanish hardcore bukkake uncut .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\kicking hardcore full movie boots .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\canadian lesbian animal hot (!) .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..s-ime-eashared-ihds_31bf3856ad364e35_10.0.19041.1_none_e8996b7d3512363f\canadian fetish [milf] .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-engineshared_31bf3856ad364e35_10.0.19041.746_none_d404daff82e97769\spanish gang bang catfight latex .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\japanese kicking lesbian traffic .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\gang bang cum hot (!) ash girly .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_en-us_64f5aaf4bb13ecef\indian nude fetish [milf] bedroom .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet-nonwow64-shared_b03f5f7f11d50a3a_4.0.19041.1_none_d66d07dacac85e2d\danish fetish action lesbian cock .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\asian horse masturbation stockings .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..templates.resources_31bf3856ad364e35_10.0.19041.1_en-us_8dd6053a0a5910eb\cum lesbian voyeur bondage .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\beast fetish big beautyfull .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.1151_none_025296d718a7b3a8\beastiality horse masturbation .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\cumshot licking vagina beautyfull .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\chinese horse beast big Ôï (Sonja,Melissa).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.746_none_ab42fb092bda9182\asian cum lingerie girls Ôï .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.746_none_2212358fc33cc10f\french animal xxx lesbian bondage .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ntlmshared_31bf3856ad364e35_10.0.19041.1_none_734900fc110387b6\asian bukkake trambling girls high heels .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\swedish action [bangbus] young .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\cumshot catfight bedroom .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\russian animal trambling several models (Ashley,Jenna).rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\british porn hardcore sleeping glans sm (Janette).zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\kicking public Ôï .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_5abbd3c4a3f2014c\lesbian beastiality voyeur boobs .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\cumshot big hairy (Jenna,Samantha).mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\british lesbian girls .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_aaeae146be52e178\cumshot gang bang public .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\french horse fetish hidden redhair .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\fucking hidden feet bondage .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\french porn [milf] (Liz,Liz).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_99ddc8ce8d3d6dac\indian nude uncut cock .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\beast lesbian masturbation nipples .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\malaysia fucking nude public hole mature .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.844_none_855aff45853749ef\blowjob porn licking femdom (Jade,Gina).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\brasilian beast gang bang [free] nipples penetration .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\sperm blowjob big pregnant .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\SoftwareDistribution\Download\tyrkish nude blowjob [bangbus] glans (Jenna,Sarah).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\swedish fetish bukkake uncut .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_es-es_64c107d8bb3ade94\porn lesbian sleeping blondie .avi.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_perfcounter_31bf3856ad364e35_10.0.19041.1_none_a723631dce180fe0\asian gay [milf] .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\lesbian bukkake [free] .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\fucking lesbian shoes .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_359f84f8e5af60e2\canadian beast [free] sm .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\cumshot voyeur redhair .zip.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\gang bang big black hairunshaved .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\cum catfight 50+ .mpg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ineshared.resources_31bf3856ad364e35_10.0.19041.1_en-us_a4327320c19e2fa7\african lingerie big .mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\norwegian xxx hot (!) glans (Christine).mpeg.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ces-ime-eashared-lm_31bf3856ad364e35_10.0.19041.1_none_3d0229d17c310f10\horse [milf] .rar.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exeabf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exeabf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exepid process 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe 3548 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exeabf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exedescription pid process target process PID 2084 wrote to memory of 2284 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe PID 2084 wrote to memory of 2284 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe PID 2084 wrote to memory of 2284 2084 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe PID 2284 wrote to memory of 3548 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe PID 2284 wrote to memory of 3548 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe PID 2284 wrote to memory of 3548 2284 abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe"C:\Users\Admin\AppData\Local\Temp\abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe"C:\Users\Admin\AppData\Local\Temp\abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe"C:\Users\Admin\AppData\Local\Temp\abf3bc7bd617ab5b2264fa4f6e24baccb3ce51a1c0f75fa8effbb8dd1d506ce8.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\spanish nude beastiality lesbian nipples swallow .rar.exe
Filesize1.7MB
MD5e0a00c65d747df927471c2a64afb1217
SHA13c303100720718e640d0017a0548fc52a6ba6cbe
SHA256716f582e481f23dc94495430af6a1936d68ee3c33df1ab5012d2d2706d9587f7
SHA512d9d15c617815a6d140822b90bd59f66a2c620c52a41ef621a010871f46642346b826f8796831475d00fc0f4f57979b96a409987e5c649a871467db04d1e64473