Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 07:35
Behavioral task
behavioral1
Sample
478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe
-
Size
76KB
-
MD5
0ff2332684f222fe1466d80265428d8d
-
SHA1
b31e87e4eb24a96aa799ff8d31b4482cc2c1cf09
-
SHA256
478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69
-
SHA512
d5350fc0f29de60208afedc298bf12201655c8f31e821d6ea2c4f4e8e1c23ed6a2b61ad4c0b8885e3c626292a8a6459d3e6038e3f7171653ac32f7077d9a11f6
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSpO4AmCL3i9YYY8/x:5JjcF8KfCOcjk+guPVjSpXd19Y7m
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1336-54-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral1/memory/1336-55-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\play station emulator crack.exe 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\sexy little blonde teasing.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\two teen lesbians with dildo having fun.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\two studs gangbanging a hot little sluts holes.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\fat grannies action.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\mature show older pussy and happy to do it.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\asian studys how to strip.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\jenna jameson - xxx nurse scene.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\shy teen draining the juice from 2 cocks.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\hardcored blonde mature.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\black dude gettin it with two white hoes.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\big dicked shemale being boned.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\wild ebony slut taking two cocks.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\redhead getting a group facial at a wild party.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\sexy hot looking horny ebony teens.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\sylvia lauren showing her assets.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\prego housewifes large hole .mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\winxcfg.exe 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\anastasia nude.exe 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\sexy pink pussy girl taking it off.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\16 year old webcam.mpg.exe 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\Preteen Rape Sex Illegal - Jenny - 13 Years old.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\little chicken shy about exposing sweet cunt.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\babe doing boyfriend and his buddy.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\slutty cum babes sharing a dick.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\kitty-cat with horny beaver that needs licking.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\tight anal fucking like you want it.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\aimcracker.exe 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\leggy babe posing in pink panties.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe File created C:\Windows\SysWOW64\macromd\toying blonde with fucking machine.mpg.pif 478ff855f69ef48aab102bb0510f11d50528edf7587255960a881eead0310f69.exe