757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f

Analysis

max time kernel
170s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
Size

93KB
MD5

a023618e7ecbda78b137040bd9b6e6c0
SHA1

644abe11a6a00cf931056878966080b15c68a534
SHA256

757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f
SHA512

4f97241f1f184d4c7d8c0a6c6edcf35f0dba78fade8bf01b01de3c2f977994cfd22e3a29108be3d828cd0ad4de9e2339d570b1a757ca036fb57ec1ef822762e7
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSlfwGX2z+LJYHeukJ7YJB:5JjcF8KfCOcjk+guPVjSloGmWZIX

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1172-132-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/1172-133-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\play station emulator crack.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\AIM Flooder.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\cute honie spreading flawless ass and juicy twat.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\couple babes getting off with well hung dude.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\sexy beautiful soon to be pornstar.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\nice facial cumshot for slut.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\hard cock cumming in her mouth.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\hot tomoli lathering up sexy body for boyfriend's tongue.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\lesbians lickin and toying.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\cartoon babe sucking and fucking sex .mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\cute girl giving head.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\toonie getting fucked in the library.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\the skirt of a babe on the stairs.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\XXX Porn Passwords.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\Two girls - Blonde and Brunette - Giving head.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\slutty cum babes sharing a dick.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\busty older bitch gets slammed.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\ebony girl with massive hooters.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\sweet teen lesbians licking snatch.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\latina shemale playing with her cock.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\wife in kitchen preparing hot pussy for hubby's dinner.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\uncle fred spanking his young nieces little ass.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\nasty teen posing in panties.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\hot blonde teen sucking old dick.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
File created	C:\Windows\SysWOW64\macromd\toying blonde with fucking machine.mpg.pif	757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe

C:\Users\Admin\AppData\Local\Temp\757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe
"C:\Users\Admin\AppData\Local\Temp\757e719f2e5988bcf44b49e95bf05a3c18887f2354c16133cf6396b95f3c808f.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1172-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1172-133-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download