Analysis
-
max time kernel
165s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 05:48
Behavioral task
behavioral1
Sample
36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe
-
Size
96KB
-
MD5
136f22b51103d8d24a4bd60b2b9c9f50
-
SHA1
2dd15bff617eb0bcece11de2a2cfbd2aae81106a
-
SHA256
36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9
-
SHA512
0a50d7e1adeff01fd5b7f7521fac5386d366aa6c75b54ec7a22c7427230c1dc0ff0633430da5bf6fd594990de8e9595251f734e85c4ff9be32d1bfb36f19d7c9
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSw9IkHzL5rOIt6rxs0+U6rLIwx:5JjcF8KfCOcjk+guPVjSwHzL9mS0Wrhx
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2900-132-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/2900-133-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\babe with dick stuck between her ass cheeks.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\two large black bones in a small white box.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\busty blondie with cool ass.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\uptown girl with great ass that should be illegal.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\toying blonde with fucking machine.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\Yahoo mail cracker.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\win2k serial.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\hot tomoli lathering up sexy body for boyfriend's tongue.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\young slut being pound in all her tight holes.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\Universal Game Crack.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\honie with thick ass spreading her money maker.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\shy teen draining the juice from 2 cocks.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\hairy lezzies torching it up with hot candles.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\little brown cup-cake with plump boobs and sweet beaver.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\polish naturals with nice round titties.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\head rooster pimping hot little tender ass chickens.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\horny teen waking up with her pink pussy spread.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\sexy blonde teasing pussy.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\naturaly tan babe with gorgous body.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\winxcfg.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\illegal preteen porn anal fisting.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\honie displaying raw pink ass.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\an asian bush getting a cum bath.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\violent preteen gang bang illegal.mpg.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\gettin it hard up the ass.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\asian getting a taste of pork.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\DivX pro key generator.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\aol password cracker.exe 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\horny housewife looking for some action.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe File created C:\Windows\SysWOW64\macromd\swimmingpool threesome fuck suck group sucking.mpg.pif 36db046af63d5c36f9dcc6a5613f0c427a7dc7d14ce60de848687e575f3a5ec9.exe