Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2022 21:24
Behavioral task
behavioral1
Sample
479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe
-
Size
71KB
-
MD5
a35df223b76554acba0267cecec094f0
-
SHA1
0cbc52bc50888832e9d9413caba0780a9c9fc516
-
SHA256
479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057
-
SHA512
02bce85f84369d8d0d4c2906f1f5e1abe9948ef97973d94ea7dd213231c444437f574e18cbc76f6604ca569b6b32c33b07236e5bd5f3348c57fae0f49a43dda7
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSALl7Q1:5JjcF8KfCOcjk+guPVjSKl7Q1
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1692-132-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/1692-133-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\babes with oversized hooters spreading.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\hot babe showing her pussy and wanting a stiff cock.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\action with three chicks getting it on with a guy.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\blonde doing dildo outdoors.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\robin throating and fucking.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\Free Porn.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\Counter Strike CD Keygen.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\siemens unlocker.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\3 teen blonde babes chin deep in pussy sauce.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\Hotmail Hacker.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\Universal Game Crack.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\her taking a dildo right in the ass.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\winxcfg.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\cute blonde cheerleader dancing.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\dude getting burned out trying to fuck 2 hot babes.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\super sexy blonde showing her pink.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\gay guy with a screwing machine.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\Flash Golf.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\dude getting off in lover's mouth at party.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\asian studys how to strip.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\Digimon.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\busty asian babe with a hairy box.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\aimcracker.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\stud fucking his blonde french maid.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\trio having hardcore fucking fun.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\busty asian with big lips.mpg.pif 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe File created C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe 479fdb90b1f99703833d345968223cb74f454d765c686c3dce137b6b39649057.exe