Analysis
-
max time kernel
124s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19-10-2022 19:02
Behavioral task
behavioral1
Sample
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe
-
Size
79KB
-
MD5
a19c0bd69b65266f83d8a9bdf7341560
-
SHA1
f1b02692f7b43452cde92aa31c5e722f5f672df1
-
SHA256
997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07
-
SHA512
da6f6c1bf5ad3f6f0f51cf1356ce16220ba0c99489e1ffccf934006bc714c254ecd92b9b83b5b48f67a1bafb773a7d30adc5c410151bd9f1c68a4640a1a07e98
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSCm1afXTXFp:5JjcF8KfCOcjk+guPVjSC1TH
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1760-132-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/1760-133-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\Flash Golf.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\two studs gangbanging a hot little sluts holes.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\crazy old man playing young teen.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\amateur babe showing pink.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\babes with an assortment of delicious big juggs.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\yahoo cracker.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\sluts who are in control of their slaves.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\hairy lezzies torching it up with hot candles.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Windows 2000.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\pigtail black babe with pretty boy.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Winzip.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Cable Modem Uncapper.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\win2k serial.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\cute teen fingering herself on the sofa.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\winxcfg.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\OfficeXP Keygen.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Napster Clone.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\babe locking lips around her man's rod in backyard.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\ebony spreading her pink wet pussy.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\babes getting facials and riding cocks.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\celeb's toes being suck by body-guard.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\gangbang tryout with young slut and two studs.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\babe leading pussy-whipped stud around by her cunt.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe File created C:\Windows\SysWOW64\macromd\older blonde showing she has the goods.mpg.pif 997970d2ea06c9c69c4d3f7429626cef50e68e999d6bfeda2d82a17508539d07.exe