Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 19:11
Behavioral task
behavioral1
Sample
016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe
-
Size
85KB
-
MD5
a21a019901f7a91c892a9196d6c2c7f0
-
SHA1
d2b4c537d9f332750b1a394ff8e0dffd320eac06
-
SHA256
016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a
-
SHA512
83a31761c42ee978d45c996c5d8da9f0c798e9a7c1bdc3dd811721d18e12608adbf325277febbc145b7195fc4737b6f74cb3457e3b710d523b2b903f7e0f57d2
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSLZ7s9fZ45FzU:5JjcF8KfCOcjk+guPVjSL9YfZ/
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1316-132-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/1316-133-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\winxcfg.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\brutal preteen porn xxx.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\virtua girl - bailey short skirt.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\hot slut with a big dildo.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\Hotmail Hacker.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\Website Hacker.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\horny little blonde spreading pink.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\hotties sucking boobs and eating snatch in large bed.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\cute teen fingering herself on the sofa.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\sexy hot teens gettin busy in shower.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\old lady in bra and corset with dildo.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\hot babe showing her pussy and wanting a stiff cock.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\divx pro.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\AIM Flooder.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\two hot college girl fucking in class.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\little brown cup-cake with plump boobs and sweet beaver.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\redhead getting a group facial at a wild party.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\cutie nailed up the ass.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\hard 3 way fuck in car shop.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\chicks working orgasm from dude's cock as a present.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\babes letting dudes assault their furballs.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\sluty cock sucking chick.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\both holes fucked by a massive fucking machin.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\amateur babe showing pink.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe File created C:\Windows\SysWOW64\macromd\cute teen with her hole spread wide open.mpg.pif 016fdb5749aff308af963f62e9ae02f9e342317f0e8ea5ae6c32a4801d0bf46a.exe