65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
Size

86KB
MD5

5389bd9d8fa5d4e04e11c6bf4cb6937f
SHA1

b93114d8169bb7c33b1f4c9eabf79543b1c32b38
SHA256

65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954
SHA512

62bb89f07d37951fa4497cdd321a908f017458b945ae4f72fc5feab75be325e33a0c598b8556cc2366c3fc6c453191eee3ec348773ce7b9bb3cd78a4224bd3ad
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSbfsT2VWj8e6bDuc:5JjcF8KfCOcjk+guPVjSb9o6n3

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/360-54-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/360-55-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\dedicated honie giving dude a helping hand and head.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\babe locking lips around her man's rod in backyard.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\aol password cracker.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\3 teen blonde babes chin deep in pussy sauce.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\fun slut who let dude eat her off in jacuzzi.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\hot busty amateur babe stripping and spreading.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\happy babe who got 12 inches last night.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\pornstar aria giovanni .mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\msncracker.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\brutal preteen porn xxx.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\babes taking turns munching on hot beavers.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\hotties sucking boobs and eating snatch in large bed.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\babes with oversized hooters spreading.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\both holes fucked by a massive fucking machin.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\nasty chick in hardcore fucking.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\swimmingpool threesome fuck suck group sucking.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\icqcracker.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\Winzip.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\momma's juggs that make you scream for mercy.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\polish naturals with nice round titties.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\amateur getting off in the mirror.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\dude getting burned out trying to fuck 2 hot babes.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\asian getting a taste of pork.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\babes getting facials and riding cocks.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\XXX Porn Passwords.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
File created	C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif	65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe

C:\Users\Admin\AppData\Local\Temp\65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe
"C:\Users\Admin\AppData\Local\Temp\65ca8abb54886649940e2c1d8f95384a35e94b6b33b637fe0d623f8445e2d954.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-54-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/360-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download