Analysis
-
max time kernel
94s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 02:19
Behavioral task
behavioral1
Sample
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe
Resource
win10v2004-20240611-en
General
-
Target
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe
-
Size
623KB
-
MD5
2abf09941db488f850f1783e882284c3
-
SHA1
45e3a08a7904dbe4c1da8f771d65ca72d8639494
-
SHA256
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970
-
SHA512
7ba11d461ea89550acf92ec2f1c89c986b0a08c94c09a1c444db9056f739d017b7dd6bb1f16fda48ceb3340647e0caf57fd1cea6698ed1d358e103bb081e42b8
-
SSDEEP
12288:lEQoSfqaDJYMCQEqO5XJP1wCqt9bKuHLfVNJUhiXhJhG3tF8nW8s0LE:l4lQ9sgxdfVNgiXhDZnW8bE
Malware Config
Signatures
-
Detects executables containing possible sandbox analysis VM usernames 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4260-58-0x0000000000400000-0x0000000000456000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2636-56-0x0000000000400000-0x0000000000456000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2176-197-0x0000000000400000-0x0000000000456000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/1664-198-0x0000000000400000-0x0000000000456000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/4260-202-0x0000000000400000-0x0000000000456000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames behavioral2/memory/2636-201-0x0000000000400000-0x0000000000456000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SandboxUserNames -
UPX dump on OEP (original entry point) 9 IoCs
Processes:
resource yara_rule behavioral2/memory/2176-0-0x0000000000400000-0x0000000000456000-memory.dmp UPX C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake handjob [milf] fishy (Jade).mpeg.exe UPX behavioral2/memory/1664-11-0x0000000000400000-0x0000000000456000-memory.dmp UPX behavioral2/memory/4260-58-0x0000000000400000-0x0000000000456000-memory.dmp UPX behavioral2/memory/2636-56-0x0000000000400000-0x0000000000456000-memory.dmp UPX behavioral2/memory/2176-197-0x0000000000400000-0x0000000000456000-memory.dmp UPX behavioral2/memory/1664-198-0x0000000000400000-0x0000000000456000-memory.dmp UPX behavioral2/memory/4260-202-0x0000000000400000-0x0000000000456000-memory.dmp UPX behavioral2/memory/2636-201-0x0000000000400000-0x0000000000456000-memory.dmp UPX -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exec2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2176-0-0x0000000000400000-0x0000000000456000-memory.dmp upx C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake handjob [milf] fishy (Jade).mpeg.exe upx behavioral2/memory/1664-11-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4260-58-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2636-56-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2176-197-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/1664-198-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/4260-202-0x0000000000400000-0x0000000000456000-memory.dmp upx behavioral2/memory/2636-201-0x0000000000400000-0x0000000000456000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exedescription ioc process File opened (read-only) \??\Y: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\A: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\L: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\O: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\R: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\U: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\Z: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\H: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\I: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\J: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\P: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\T: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\S: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\V: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\B: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\G: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\M: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\N: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\Q: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\E: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\K: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\W: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File opened (read-only) \??\X: c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe -
Drops file in System32 directory 12 IoCs
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exedescription ioc process File created C:\Windows\System32\LogFiles\Fax\Incoming\swedish animal masturbation fishy .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\spanish animal blowjob licking feet .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\brasilian lingerie [milf] shoes .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\config\systemprofile\chinese horse fucking sleeping .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\FxsTmp\porn gay several models .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\russian cumshot cumshot sleeping leather .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\config\systemprofile\kicking uncut .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\System32\DriverStore\Temp\trambling hot (!) nipples .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\FxsTmp\fucking animal big bondage (Curtney,Sylvia).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\IME\SHARED\swedish gang bang kicking uncut glans latex .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\IME\SHARED\lesbian masturbation cock .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\norwegian cum handjob sleeping (Sandy,Samantha).mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe -
Drops file in Program Files directory 20 IoCs
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exedescription ioc process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\handjob several models castration (Sonja,Samantha).mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\gang bang catfight glans femdom .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFD7095D-03FC-4A5C-948B-20FAB1B69302}\EDGEMITMP_4CFFA.tmp\japanese sperm big (Janette).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Microsoft\Temp\EUA671.tmp\cum girls penetration (Jade).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\danish porn gay lesbian castration .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\xxx [milf] (Samantha,Ashley).rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\canadian gang bang horse public wifey (Tatjana,Jenna).rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\xxx fetish masturbation vagina bedroom .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Google\Temp\canadian fucking [free] cock .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Google\Update\Download\action licking ¼ë (Sonja,Gina).avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\Common Files\microsoft shared\blowjob beast public legs .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\dotnet\shared\russian fucking [milf] .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\norwegian handjob licking hole (Curtney,Karin).mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Microsoft\Temp\horse porn several models beautyfull (Kathrin).rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\gang bang [bangbus] boobs girly .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\Microsoft Office\root\Templates\chinese lingerie big feet bondage .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake handjob [milf] fishy (Jade).mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\Microsoft Office\Updates\Download\british fetish catfight .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\trambling licking castration .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\porn voyeur boobs circumcision .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe -
Drops file in Windows directory 64 IoCs
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exedescription ioc process File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\italian trambling fucking [bangbus] .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_e5f85095c4bc5d16\kicking bukkake public .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.746_none_292c449ed2edefa3\norwegian lesbian cumshot hidden granny (Sarah,Christine).mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93c5f32b7859ec4f\african action lesbian beautyfull .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.746_none_b53f8b98f2b3a373\german blowjob gang bang voyeur sm .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\italian lingerie girls ash .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\norwegian handjob nude several models glans femdom .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..filedownloadmanager_31bf3856ad364e35_10.0.19041.1_none_cb69bad627df9263\horse [free] titts black hairunshaved (Sonja,Kathrin).mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_e2f5ebbcec2d8fca\trambling nude [bangbus] .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-upshared_31bf3856ad364e35_10.0.19041.84_none_85259eff919b7c9e\brasilian fetish hot (!) young (Liz).mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_551afa5edf8be30e\kicking horse hot (!) wifey .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\brasilian cum [free] Ôï .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vsssystemprovider_31bf3856ad364e35_10.0.19041.1_none_01240756137c3159\fucking catfight feet ash .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\fucking lingerie several models .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.572_none_cf90e12518baac85\handjob catfight balls .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..nearshareexperience_31bf3856ad364e35_10.0.19041.1288_none_ca3007304990b2ea\american lesbian hot (!) boobs shoes .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\spanish beastiality [milf] fishy .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedpc-sharedpccsp_31bf3856ad364e35_10.0.19041.746_none_4cfe603abbcbfd86\lingerie kicking several models redhair .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_netfx4-_dataperfcou.._shared12_neutral_h_b03f5f7f11d50a3a_4.0.15805.0_none_24ed4511dcc3019e\russian beast bukkake several models sm .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\Temp\japanese sperm handjob catfight (Anniston).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\african beastiality cum catfight black hairunshaved .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_5af076e0a3cb0fa7\british xxx public swallow .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\japanese animal hidden feet (Ashley).mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\black cumshot [free] cock latex .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\swedish kicking horse masturbation wifey .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..tyvm-sysprep-shared_31bf3856ad364e35_10.0.19041.1_none_3ba048793ab5eb3f\italian cumshot animal [free] .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-filemanager_31bf3856ad364e35_10.0.19041.1_none_67a96afcfa248327\chinese cumshot fucking big hole .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\african fucking lesbian .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\danish sperm girls glans sm .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\spanish beast girls redhair (Sonja).rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_b1ffa0e7b4ed03e2\malaysia kicking gang bang sleeping (Kathrin,Karin).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\indian animal gang bang [milf] stockings (Sandy,Christine).avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_4c786ae2f508e6d5\handjob licking bedroom .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\horse nude [milf] wifey (Sonja,Jenna).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_ca03036af4a5017e\porn cumshot catfight (Liz,Britney).rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\PLA\Templates\beast voyeur .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\chinese horse lesbian balls (Sylvia,Anniston).avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_it-it_f1a0741e853eda74\lingerie masturbation (Curtney,Gina).avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..boration-sharer-api_31bf3856ad364e35_10.0.19041.84_none_cee95e04c201c860\asian lingerie big .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\japanese horse licking nipples (Kathrin).mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\italian sperm porn big .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..olicy-admin-admtmpl_31bf3856ad364e35_10.0.19041.1_none_a7ad1894592cfa12\american hardcore porn hot (!) glans YEâPSè& .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\asian cumshot lesbian .mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_965fbcbe4df0916b\brasilian handjob full movie gorgeoushorny (Tatjana,Samantha).mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorwks_31bf3856ad364e35_10.0.19041.1_none_d980e9752d51efac\french sperm sleeping lady (Sonja,Tatjana).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\x86_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_bde408a455fc3ece\swedish cum horse catfight .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\beastiality animal masturbation 50+ (Sylvia).avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mon-sharedresources_31bf3856ad364e35_10.0.19041.1_none_5417ea1f38dbb76b\beast horse several models boobs balls .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_netfx4-installsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_7636d1cd418015c8\malaysia nude licking penetration (Samantha).avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-ime-eashared-proxy_31bf3856ad364e35_10.0.19041.1_none_56cd15352969a8d0\fucking hidden balls .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sx-shared_31bf3856ad364e35_10.0.19041.1_none_ee94ce5eb8e7e4c0\russian lesbian porn lesbian (Melissa).zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.1_none_e32b64807ab11fd2\spanish cumshot lingerie catfight .avi.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\tyrkish fetish masturbation hole circumcision .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\swedish hardcore sleeping .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_10.0.19041.1_none_8d8f6812a0c99533\tyrkish beastiality public girly .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\InputMethod\SHARED\danish gay animal voyeur redhair .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\japanese beastiality nude [free] sweet .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_netfx4-uninstallsqlstatetemplate_sql_b03f5f7f11d50a3a_4.0.15805.0_none_db70a8ec1b999dd5\italian nude blowjob [bangbus] vagina .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse lesbian bedroom (Sandy,Curtney).mpeg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_netfx-shared_registry_whidbey_31bf3856ad364e35_10.0.19041.1_none_1c68775f06732f08\tyrkish trambling masturbation .zip.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\malaysia porn porn lesbian bondage .rar.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_62312bfbb33d478a\italian blowjob cumshot licking balls .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\trambling porn licking .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..acejoin-gptemplates_31bf3856ad364e35_10.0.19041.1_none_609f27436445f4da\cumshot [bangbus] granny .mpg.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exec2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exec2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exec2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exepid process 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 4260 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe 2636 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exec2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exedescription pid process target process PID 2176 wrote to memory of 1664 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 2176 wrote to memory of 1664 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 2176 wrote to memory of 1664 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 1664 wrote to memory of 4260 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 1664 wrote to memory of 4260 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 1664 wrote to memory of 4260 1664 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 2176 wrote to memory of 2636 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 2176 wrote to memory of 2636 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe PID 2176 wrote to memory of 2636 2176 c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"C:\Users\Admin\AppData\Local\Temp\c2753e1e7246bfdf3eb1f4ec7d289b7faaa135067825fff0e140ebfb3edc8970.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4472,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake handjob [milf] fishy (Jade).mpeg.exeFilesize
1.4MB
MD5e31d60efe3979f0a55e0ef7c12501bb1
SHA172555499b196dbcf52381a9e06ade00907ad68c2
SHA2569fce92e886b65ae7a3be316ec021dae9a1fb237e48b2cfac5cd2e73d0dd1335e
SHA512c6e402a4fce4381bfa2abf5b26435d48afe5af932c7021f90bd4cbbceb76893496a6ed57fe23592ae46ba2ff9383de5ecdcca77e7ee78c99b4d29ecfc9ca21b7
-
C:\debug.txtFilesize
146B
MD5c7a169e75106da23d0039de9f59f6ea5
SHA19f92a182a6c037e67399a83a3992cbb6ea6ceb03
SHA256f891dc2ae88948e8c228d0018d802438796d3cb6f020d945f46801450b1d9a1b
SHA512f8a97ed46fcca658ea1f133623bf1bd7a042c7c58e584fefa53a41aa447b9fd2af3754a88abc03e5023eed99c7562ab02abe625d42f450d03451e6b2efba7124
-
memory/1664-11-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1664-198-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2176-0-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2176-197-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2636-56-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2636-201-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4260-58-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/4260-202-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB