93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1

Analysis

max time kernel
29s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 21:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
Size

93KB
MD5

a391e21eb6b1f05fd05f121a32034e40
SHA1

2b3e089cf5ef321e69a923969d9a3fd1144565b1
SHA256

93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1
SHA512

108106e9e31c341bed5e5fac8b0e0478d15e4bf2d0a60c2aa0aaf7b3ee4b6ee461fdd56e1a7ef5899849f1d58795c6a5f1596bc765fce47b69fde49b48f7dec4
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSsU5rRZ3yoc7ny6G8JiQP:5JjcF8KfCOcjk+guPVjSJ3yr08N

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1628-54-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral1/memory/1628-55-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\blonde beauty ass fucked.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\virtua girl - bailey short skirt.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\hot busty amateur babe stripping and spreading.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\an older fat mom spreading wide.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\hot anita blonde doing lesbo.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\cute petite amateur girl spreading her snatch.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\redhead getting a group facial at a wild party.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\old man fucking young blonde teen.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\hard 3 way fuck in car shop.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\Harry Potter and the sorcerors stone.divx.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\mature show older pussy and happy to do it.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\OfficeXP Keygen.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\old lady in bra and corset with dildo.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\her taking a dildo right in the ass.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\nice facial cumshot for slut.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\hotties sucking boobs and eating snatch in large bed.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\luscious babe with serious ass and firm titts.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\gangbang tryout with young slut and two studs.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\busty asian babe with a hairy box.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\play station emulator crack.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\slut mouth open wide to take dick in.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\GTA 3 Crack.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\an asian bush getting a cum bath.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
File created	C:\Windows\SysWOW64\macromd\sylvia lauren showing her assets.mpg.pif	93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe

C:\Users\Admin\AppData\Local\Temp\93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe
"C:\Users\Admin\AppData\Local\Temp\93146206301e8001fe1c4de5e0eaafdb07bf05ce5bb361ffca79753f2d0663e1.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-54-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1628-55-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download