7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85

Analysis

max time kernel
149s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
Size

86KB
MD5

a0b5a6b1164f3dd05cee993ebc43dd90
SHA1

ffd0407a257f0c3c94dc57bcd8ba00a6295c9a4b
SHA256

7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85
SHA512

360caa72186ee2656b178ec28a654c73c423ad59361a36c74ce601642cbc7a105e321ae087926e124d3ecedccc66144196097cd61e448490ad22a194e5f57da3
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSEUmEAGmw4Xfpqadveommx+:5JjcF8KfCOcjk+guPVjSAEAGmw4Xfpqf

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1864-132-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/1864-133-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\long hair busty pussy girl.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\nude.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\nasty slut sucking huge cock.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\lonely teen thinking of cock while fingering it.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\cute blonde chick riding cock.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\spying on gals in toilet.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\hot bigger babe with huge hooters.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\bitches in the great outdoors.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\cute teen with her hole spread wide open.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\aunt and nephew doing the nasty.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\trannie posing as a princess.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - shower scene.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\two hot college girl fucking in class.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\two dudes comparing dick sizes.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\pigtail black babe with pretty boy.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\lezbos in pantyhose swapping tongues.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\Harry Potter and the sorcerors stone.divx.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\MSN Password Hacker and Stealer.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\uptown girl with great ass that should be illegal.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\gay twink sucking off a gay shemale.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\busty asian babe with a hairy box.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\lucky lesbians licking outdoors.mpg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\Lolita preteen sex.mpeg.pif	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\msncracker.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
File created	C:\Windows\SysWOW64\macromd\AIM Flooder.exe	7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe

C:\Users\Admin\AppData\Local\Temp\7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe
"C:\Users\Admin\AppData\Local\Temp\7b9bd6385deea956b215105c7c504000f44e4c4a5ce3fa1b1057ab87454dfc85.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1864-133-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download