Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 09:56
Behavioral task
behavioral1
Sample
ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe
-
Size
85KB
-
MD5
a27fd66a192b8a3562ab23715d83562a
-
SHA1
0296597d244626db301f0374b9e4c8fe6959e1d1
-
SHA256
ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301
-
SHA512
7784a235a81509866c1af695cded61141b06b7ad1ac914e3201a3a04f82233af5cc634d5101779eb76ec52198b872307347cb42229b888c7d814d4adfa6f2a27
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSQhZgco78BeTaN58PkmHH:5JjcF8KfCOcjk+guPVjSg07YeiItn
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1720-54-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1720-55-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\teen tied up and raped.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\OfficeXP Keygen.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\AIM Password Stealer.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\AIM Account Stealer.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\yahoo hacker.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\blonde doing dildo outdoors.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\extremely fine hoine with incredible sweet twat.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\an older fat mom spreading wide.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\tight anal fucking like you want it.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\Norton antivirus 2002.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\password stealer.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\amateur swinger babe sucking on a couple of cocks.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\winxcfg.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\aol password cracker.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\illegal porno - 15 year old raped by two men on boat.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\gorgious babe who quit school to model pretty pink.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\black girl gets dildo wet.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\Windows 2000.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\two sexy blondes share a cock.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\this really wild insane groupsex.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\sexy hot looking horny ebony teens.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\hotmailhacker.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\Free Porn.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\MSN Password Hacker and Stealer.exe ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\blonde showing her pussy to her neighbor.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\asian getting a taste of pork.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe File created C:\Windows\SysWOW64\macromd\celeb's toes being suck by body-guard.mpg.pif ff5226f2455aa7287f472ff87971aa98e1287e2052ac2b2bf439da7950524301.exe