2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d

Analysis

max time kernel
21s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
Size

84KB
MD5

a151fe6d3f1ee43700b1667b8de50030
SHA1

b511bc2fa947b41c2548fc2f23fc9b8dd053b894
SHA256

2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d
SHA512

35cd7c90b0bbb29b1f60799fb60e0d7ec075e2f85ec530c270430fa005fd988883b5d4f44359765ab38c97ae143c09bcb91fb97bdba9d89fb337c512f0500e59
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSV8AEDuU4fADArN4:5JjcF8KfCOcjk+guPVjSVtEDu5fADArq

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-54-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/1668-55-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\tight anal fucking like you want it.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\2 horny babes doing 1 lucky dude.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\polish naturals with nice round titties.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\ass ripping interracial fuckin.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\yummy lesbos licking.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\hardcored blonde mature.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\firm ass honie with thick lips made for sucking rods.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\sluty cock sucking chick.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\swimmingpool threesome fuck suck group sucking.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\some twink ass rippers.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\cute girl giving head.exe	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\babe celebrating new years naked and spreading cunt.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\asian slut with puffy exotic lips.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\gangbang tryout with young slut and two studs.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\wife in kitchen preparing hot pussy for hubby's dinner.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\babes getting big cocks off with lips.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\two kinky old lezbos snapping the whip.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\bigger chunky girl with huge tits posing in the buff.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\beautiful blonde gettin an anal fucking.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\busty asian babe with a hairy box.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\ebony spreading her pink wet pussy.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\cum hungry slut accepting goop.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\virtua girl - adriana.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\Flash Golf.exe	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\senior blonde fucking and suckin like a teen.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\sexy star kate hudson nude.mpg.pif	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
File created	C:\Windows\SysWOW64\macromd\Play Games Online For FREE.exe	2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe

C:\Users\Admin\AppData\Local\Temp\2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe
"C:\Users\Admin\AppData\Local\Temp\2b37c48abd7b9aa366d298bd623b8ac59a599bc321e4d97cc5ed11b359abb50d.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1668-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download