Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 09:59
Behavioral task
behavioral1
Sample
c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe
-
Size
72KB
-
MD5
a300cbbf45f0e6d22a4a9807447b7aa0
-
SHA1
e2fb2609fd5c3137c8fdc33fe715d279ce78e5ac
-
SHA256
c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb
-
SHA512
15e1352d8f80d1660d7a475bfafbc646b2687c8deb31a6340965e4a387f3916079615cdca8fc0cce166907079587258ce19c91bcde7588929504a7c9179d439f
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSQApQY:5JjcF8KfCOcjk+guPVjSQApQY
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1064-54-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1064-55-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\Another bang bus victim forced rape sex cum.mpg.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\hotmailhacker.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\anastasia nude.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\babes with great lips that knows how suck cock.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\leggy babe posing in pink panties.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\winxcfg.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\play station emulator crack.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\invisible IP.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\chicks eating hot meaty pussy.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\porn account cracker.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\Harry Potter and the sorcerors stone.divx.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\aol password cracker.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\chicks working orgasm from dude's cock as a present.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\hot busty amateur babe stripping and spreading.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\strange asian ass odyssey.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\anal fisting ass fucking and double penn.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\glamour babe in black stockings.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\tiny little virgin showing off her cherry pussy.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\teen spreading in the kitchen.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\babes with an assortment of delicious big juggs.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\hot blonde teen sucking old dick.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\hot blonde fucking and sucking cum.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\jessica shows us her fat fisting.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\chubby girl bukkake gang banged sucking cock.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\babe celebrating new years naked and spreading cunt.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe File created C:\Windows\SysWOW64\macromd\two studs gangbanging a hot little sluts holes.mpg.pif c694181558385e8e0ea90dc36b06e563baf129d8c15cfb49e0edb5b027f5fdcb.exe