a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe

General

Target

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
Size

162KB
MD5

52ae80d273db8592b6eb4da55f37dcb0
SHA1

7f8542d919fe98d235c460695c780d23aa2a5028
SHA256

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe
SHA512

05ecf79f84be053938026f7d0dff1f0644d4b8e2183b4ef08b708adf59f18b35a2a904b604299cd83a329dd3c7f3ebee85bab2f724c17355d386f54ad3f42abf
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08MoeMx84EGrDd/M:aM7jJlRexYTHYZMn4rrDd/M

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

Drops file in System32 directory 33 IoCs

Processes:

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\winxcfg.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\nude.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\nice girl showing her tits for extra money.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\action with three chicks getting it on with a guy.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\old fucker punishing teeny.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\asian slut with puffy exotic lips.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\nurse in pink showing her healthy bone slot.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\both holes fucked by a massive fucking machin.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\petite ebony enjoying her joy toy.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\GTA3 crack.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\3 teen blonde babes chin deep in pussy sauce.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\honie playing in her cunt with newly bought toy.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\redhead getting a group facial at a wild party.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\babe locking lips around her man's rod in backyard.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\patricia arquette showing her tits.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\CKY3 - Bam Margera World Industries Alien Workshop.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\Winzip.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\jenna jameson - built for speed.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\wife in kitchen preparing hot pussy for hubby's dinner.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\black dude gettin it with two white hoes.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\two studs gangbanging a hot little sluts holes.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\hot japanese office sex.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\nikki nova sex scene huge dick blowjob.mpg.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\closeups of horny slut serving up sweet hairy bush.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\some hard sucking and fucking babes.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\15 year old webcam.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\nasty slut sucking huge cock.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\nasty chick in hardcore fucking.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\teen tied up and raped.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\MSN Password Hacker and Stealer.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\hardcored blonde mature.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\two interracial lesbians licking each other.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

C:\Users\Admin\AppData\Local\Temp\a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
"C:\Users\Admin\AppData\Local\Temp\a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads