Analysis
- max time kernel
124s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
19/10/2022, 19:08
Behavioral task
behavioral1
Sample
3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe
- Size 75KB
- Sample221019-xs7d3adebm
- SHA256 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59
- MD5 a13f127b4af699635c651552f995c450
- SHA1 01ca5266717c9f40797d0cd6893d802a7157c0f3
- SHA512 a145f755169c1917a3153efd30fd4fc4f3c0f6ca8b77a86d7e5adc01e63a0f5bf7154aa7b74abf856d9ea31c9b3a764d20a296cb1e84afbcc1d593fa2dfb3c8b
- SSDEEP 1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSvk6RKw8IkU:5JjcF8KfCOcjk+guPVjSvPwJU
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3140-132-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3140-133-0x0000000000400000-0x0000000000467000-memory.dmp upx - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe - Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\senior blonde fucking and suckin like a teen.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Hotmail Hacker.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Flash Golf.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\16 year old on beach.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\huge titty blonde taking in a full 12 inch cock.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\chick weeing in her pants.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\play station emulator crack.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Teen Violent Forced Gangbang.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\hot japanese office sex.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\some fine amateur pussy shots from behind.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\crazy old man playing young teen.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Norton antivirus 2002.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\redhead in red lingerie ready to fuck.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\two interracial lesbians licking each other.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\hot busty amateur babe stripping and spreading.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Britney spears nude.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\two large black bones in a small white box.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\babes getting their tender little asses corked.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\toying blonde with fucking machine.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Free Porn.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\winxcfg.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\virtua girl - adriana.pif 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe File created C:\Windows\SysWOW64\macromd\invisible IP.exe 3bec2c75837951469ace732dad360439743805f8a4cf205c456b8745b5e60c59.exe