5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
Size

92KB
MD5

a32ffd940c5f275e3b438aadcbc2b970
SHA1

d4be86e344684cf9669ee9593d78d5fd27cdcc6e
SHA256

5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510
SHA512

f21989fc4537f6b9c739e8176ea431fcdd20f534094ab6b1da96a6aeb953e953102188b0f6f9c05dda3542ae522c13448b39b4cba7801db5eea9131e71d80ca3
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSs+9MegRFWdLEplHbD+9X:5JjcF8KfCOcjk+guPVjSs+9MXRkdQpl6

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/8-132-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/8-133-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\macromd\luscious babe with serious ass and firm titts.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\cute teen fingering herself on the sofa.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\crazy old man playing young teen.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\asian girls stuffed mouth shots.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\blonde on couch gettin tight anal fucking.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\hot actress heather graham naked.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\hot teeny sucking cock.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\cute young tart on a lucky dudes cum shooter.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\MSN Flooder.exe	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\hot babes having too much fun at nude beach party.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\two teenie boppers learning to eat pussy.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\shanks who serve up smelly pootang.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\amateur slut with a huge gun.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\cock forced in some slut mouth.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\some twink ass rippers.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\cute petite amateur girl spreading her snatch.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\blonde beauty ass fucked.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\dedicated honie giving dude a helping hand and head.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\gay stud giving head and fucking.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\yahoo cracker.exe	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\16 year old on beach.exe	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\nasty slut sucking huge cock.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\babes getting big cocks off with lips.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\japanes girl getting it from behind.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\yummy lesbos licking.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
File created	C:\Windows\SysWOW64\macromd\horny ass licking lesbians.mpg.pif	5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe

C:\Users\Admin\AppData\Local\Temp\5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe
"C:\Users\Admin\AppData\Local\Temp\5e227a0d6a5fe001b9a432d30c32d919888c5857256353e22942ae09d9188510.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:8

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/8-133-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download