7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
Size

92KB
MD5

a0445f26f5be3d0020aa93320378b930
SHA1

4077bfb4c93485b9d279a12e0cc0384dbc2ecb94
SHA256

7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae
SHA512

42fa0a6ed35e5d973aca1ba6f256cc4526342cdfcfea22cadfaa4ca36c13f911ceac829eca53fdedc4a03fd7d3bdf593c090ef7de9544df491b830536ba5de9b
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSxNHPkTGmjA8Yd8I7B8FbV2:5JjcF8KfCOcjk+guPVjSx010t8l9V2

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5008-132-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/5008-133-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\sluts skirt showing some edible pussy.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\cute blonde chick riding cock.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\babe celebrating new years naked and spreading cunt.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\bigger chunky girl with huge tits posing in the buff.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\two busty sluts fucked in bathroom.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\asian girls stuffed mouth shots.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\teen hottie geting buttfucked.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson sex scene huge dick blowjob.scr	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\teen babe taken a shower.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\teen tied up and raped.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\momma's juggs that make you scream for mercy.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\dedicated honie giving dude a helping hand and head.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\two interracial lesbians licking each other.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\couple babes getting off with well hung dude.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\brownhair toon with glasses nude.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\couple beach vacation fucking.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\preteen sucking huge cock illegal.mpg.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\honies letting dudes flush mouths full of hot cum.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\nasty teen posing in panties.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\showing some hot girls share cock.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\sexy amatures sucking whole bag.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\AOL.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - shower scene.exe	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\hot blonde with giant jugs.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
File created	C:\Windows\SysWOW64\macromd\15 year old webcam.mpg.pif	7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe

C:\Users\Admin\AppData\Local\Temp\7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe
"C:\Users\Admin\AppData\Local\Temp\7b053904ed56dcd4057ecec938d93be1b496afedc6e816f048140e554068dfae.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5008-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5008-133-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download