809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0

Analysis

max time kernel
92s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
Size

70KB
MD5

83c3706e3650a4ec89d88998e2517ae1
SHA1

b9aa52662ba098cbc222e07e34529a7c517bf53d
SHA256

809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0
SHA512

cd5025ba55ea8cdc501fbe34239c602e2b203c9fe1e9a810423f77d6c7f155b18b3ce358672c957a35c67110e49e0f77b39490189fe827d2e4472b0343e8068f
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSFUglOCU:5JjcF8KfCOcjk+guPVjSFUglOCU

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4432-132-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/4432-133-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/4432-134-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\2 horny babes doing 1 lucky dude.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\swimmingpool threesome fuck suck group sucking.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\amateur slut fingering herself threw her wet panties.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\AIM Account Hacker.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\Nokia Unloker (most models).exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\plump brunette using her finger.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\hot japanese office sex.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\OfficeXP Keygen.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\Free Porn.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\play station emulator crack.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\hot girl on the beach sucking cock and fucking guy.mpg.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\hot anal sex for the first time ever.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\horny teen waking up with her pink pussy spread.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\girls with cock in hand and mouths fill with cum .mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\pornstar aria giovanni .mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\gay super heros and fairys.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\Britney spears nude.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\babe with peach shape pussy that needs it bitten.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\gorgious babe who quit school to model pretty pink.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\sexy beautiful soon to be pornstar.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\charlize theron naked.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\twin sisters tag teaming neighbors cock.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\yahoo cracker.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\Napster Clone.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
File created	C:\Windows\SysWOW64\macromd\gay stud giving head and fucking.mpg.pif	809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe

C:\Users\Admin\AppData\Local\Temp\809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe
"C:\Users\Admin\AppData\Local\Temp\809829ea7be68106d4e4b9829d81063ad71a9c0a064688570818fa4b17c135e0.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4432-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4432-133-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4432-134-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download