Analysis
-
max time kernel
48s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 19:02
Behavioral task
behavioral1
Sample
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe
-
Size
79KB
-
MD5
a19c0bd69b65266f83d8a9bdf7341560
-
SHA1
f1b02692f7b43452cde92aa31c5e722f5f672df1
-
SHA256
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07
-
SHA512
da6f6c1bf5ad3f6f0f51cf1356ce16220ba0c99489e1ffccf934006bc714c254ecd92b9b83b5b48f67a1bafb773a7d30adc5c410151bd9f1c68a4640a1a07e98
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSCm1afXTXFp:5JjcF8KfCOcjk+guPVjSC1TH
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1328-54-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1328-55-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\sexy star kate hudson nude.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\bottle blonde tramp sucking a dick dry.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\chubby girl fucked from all angles xxx.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\an asian bush getting a cum bath.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\sluty cock sucking chick.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\little brown cup-cake with plump boobs and sweet beaver.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\career girls playing with their snatch after work.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\yahoo hacker.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\slutty cum babes sharing a dick.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\winxcfg.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Choke on cum (sodomy, rape).mpg.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\genuine indian slut posing.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\jenna jameson sex scene huge dick blowjob.scr 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\hot butt sex ..unbeliveable.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Warcraft 3 battle.net serial generator.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\babes getting their tender little asses corked.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\babe locking lips around her man's rod in backyard.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\busty blondie with cool ass.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\porn account cracker.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Universal Game Crack.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\black dude gettin it with two white hoes.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\aunt and nephew doing the nasty.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\slutty japanese babe giving blowjob.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\babe enjoys juicy cumshot.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe