a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe

General

Target

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
Size

162KB
MD5

52ae80d273db8592b6eb4da55f37dcb0
SHA1

7f8542d919fe98d235c460695c780d23aa2a5028
SHA256

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe
SHA512

05ecf79f84be053938026f7d0dff1f0644d4b8e2183b4ef08b708adf59f18b35a2a904b604299cd83a329dd3c7f3ebee85bab2f724c17355d386f54ad3f42abf
SSDEEP

3072:jmVW8iTX/3RfldjjXq1+0cxxsWEL02fXcIp08MoeMx84EGrDd/M:aM7jJlRexYTHYZMn4rrDd/M

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

Drops file in System32 directory 33 IoCs

Processes:

a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\macromd\action with three chicks getting it on with a guy.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\pigtail black babe with pretty boy.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\little dicks on gay male tricks.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\old fucker punishing teeny.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\teen bisexual mmf threesome.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\sweet teen lesbians licking snatch.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\Flash Golf.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\patricia arquette showing her tits.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\porn account cracker.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\cute honie spreading flawless ass and juicy twat.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\sweet ass blonde teen with dripping wet pussy.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\petite ebony enjoying her joy toy.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\lusty teen peeing in backyard.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\winxcfg.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\babes with oversized hooters spreading.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\mature show older pussy and happy to do it.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\trailor tramp pissing for you.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\amateur slut fingering herself threw her wet panties.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\teen taking off her panties outdoors.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\two dudes comparing dick sizes.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\slutty japanese babe giving blowjob.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\krystal steal getting her bald clam filled.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\old man fucking young blonde teen.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\swimmingpool threesome fuck suck group sucking.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\first time anal and she loves it.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\prego housewifes large hole .mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\Two girls - Blonde and Brunette - Giving head.exe	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\twin sisters tag teaming neighbors cock.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
File created	C:\Windows\SysWOW64\macromd\older blonde showing she has the goods.mpg.pif	a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe

C:\Users\Admin\AppData\Local\Temp\a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe
"C:\Users\Admin\AppData\Local\Temp\a1f7ec09ffbb7b74e7629dc9b020e555c62576f2c55abba666c6dac0706737fe.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads