Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 21:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe
Resource
win7-20240508-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe
-
Size
991KB
-
MD5
4d5d495e7752c5d62ce5afc28af7ba2c
-
SHA1
04d6b209753eb288b2b8acc319bb2a4896362ad5
-
SHA256
51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c
-
SHA512
5b665598204a45200883d7f89f663eaaf9f49163614c75641254c1f692c0d2d41dd3b1258125242eb61ec2fec71b3c7ee2cb18581898230719c2c8b094234e49
-
SSDEEP
24576:oW7TfPNSgcBQpWAeO9LBPIpkT2zTsO98GXSxl/p/30:V7TfPNSgaRA9FPIw2L8xDhM
Score
9/10
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 3 IoCs
resource yara_rule behavioral2/memory/228-0-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/files/0x0007000000023240-5.dat INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4436-9-0x0000000000400000-0x000000000042B000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\B: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\H: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\L: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\O: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\R: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\S: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\N: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\P: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\Q: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\V: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\G: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\K: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\M: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\T: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\W: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\Z: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\E: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\I: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\J: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\U: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\X: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File opened (read-only) \??\Y: 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\indian porn fucking masturbation (Sarah).mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\horse uncut sm (Gina,Karin).rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\FxsTmp\black cum lesbian [milf] bedroom .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\lesbian voyeur (Liz).rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\config\systemprofile\sperm voyeur titts balls .mpeg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\IME\SHARED\blowjob uncut girly .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\beast lesbian cock shower .mpeg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\config\systemprofile\gay girls (Sarah).zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\IME\SHARED\american action fucking uncut fishy .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\italian nude gay sleeping 40+ (Kathrin,Samantha).zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\System32\DriverStore\Temp\tyrkish nude sperm [bangbus] swallow .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SysWOW64\FxsTmp\indian gang bang horse full movie feet pregnant .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe -
Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\swedish porn xxx hot (!) ejaculation .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\xxx full movie cock upskirt .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Microsoft\Temp\lingerie voyeur bondage .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Google\Update\Download\tyrkish cumshot gay lesbian wifey (Sonja,Jade).zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\indian action trambling public ash (Kathrin,Melissa).zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Microsoft Office\root\Templates\brasilian horse beast [bangbus] .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\lingerie several models titts redhair .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\american kicking lesbian voyeur hole hotel (Melissa).avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Google\Temp\bukkake catfight (Samantha).mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\xxx hidden .mpeg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\black cumshot horse public ΋ .avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Microsoft Office\Updates\Download\blowjob uncut hole .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\bukkake [free] (Karin).avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{A22979E4-D188-4AF0-A888-04FE21284B11}\EDGEMITMP_19EA3.tmp\japanese action beast hidden hotel .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\lesbian masturbation glans hotel .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Common Files\microsoft shared\bukkake [free] beautyfull .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\dotnet\shared\sperm big .avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\trambling [free] titts latex .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\lingerie uncut cock swallow .avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe -
Drops file in Windows directory 28 IoCs
description ioc Process File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\fucking several models titts beautyfull .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\black cumshot fucking [free] shower (Ashley,Samantha).rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\bukkake sleeping cock .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\american cumshot lesbian public hole .mpeg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\swedish kicking gay several models feet beautyfull .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\horse girls titts young (Liz).rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\trambling uncut cock (Kathrin,Curtney).mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\indian action lingerie hot (!) ash .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\russian animal lesbian [bangbus] glans girly .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\lingerie sleeping glans .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\security\templates\blowjob full movie .avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\beast sleeping titts .mpeg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\fucking licking titts leather (Karin).mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\mssrv.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\brasilian handjob hardcore [free] black hairunshaved .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\InputMethod\SHARED\gay uncut cock black hairunshaved .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\PLA\Templates\trambling voyeur hole blondie .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\CbsTemp\brasilian horse horse [milf] cock .mpeg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\gay catfight femdom .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\russian porn lesbian lesbian .mpeg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\bukkake sleeping bondage .avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\assembly\temp\swedish nude blowjob [bangbus] cock (Sandy,Curtney).zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\SoftwareDistribution\Download\blowjob public titts .mpg.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian beastiality fucking public hole high heels .rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\brasilian cumshot fucking several models girly .avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\xxx hot (!) balls .avi.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\assembly\tmp\danish handjob trambling [milf] titts .zip.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe File created C:\Windows\Downloaded Program Files\swedish beastiality bukkake [bangbus] (Tatjana).rar.exe 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 864 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 4436 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 228 wrote to memory of 4216 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 90 PID 228 wrote to memory of 4216 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 90 PID 228 wrote to memory of 4216 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 90 PID 228 wrote to memory of 4436 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 91 PID 228 wrote to memory of 4436 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 91 PID 228 wrote to memory of 4436 228 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 91 PID 4216 wrote to memory of 864 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 92 PID 4216 wrote to memory of 864 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 92 PID 4216 wrote to memory of 864 4216 51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:864
-
-
-
C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"C:\Users\Admin\AppData\Local\Temp\51d7105c09828e4d4b3651a921f68c6b970b709c974c7cb62a33e51e755f015c.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\xxx hidden .mpeg.exe
Filesize1.7MB
MD564db55a9a0346869644aef972a7b72ad
SHA15283d8363a923d1a61077551ad67c78e6e59806c
SHA2564d0a0f27ff46607d1b915875d8dee885ee17279fa9e5fd7967d7fd3b7afada23
SHA512e34c7896fe7e567bd43e30894a7cc48ed7e955734bcc1056c39783dacc2779b21f08cae4a834d96b285ab299bdff1e15cb661efcc6caba5ccc3baf8b4caf09c5