8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea

General

Target

8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
Size

78KB
MD5

42ed73d83ab820eddc4fb5f4887f57b4
SHA1

466a3351955c167f4338ee288c4ca221c602aa28
SHA256

8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea
SHA512

32d1bcc7428b84101b3a4e5597746074556b4a6e5ff69553d6ca696e854445351185f047ef3f7927ed3f0efab7225cb464f8cda155ce65024ae4e263ccfa5fbd
SSDEEP

1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMSWQkK8CvBXi2FaMKI:5JjcF8KfCOcjk+guPVjS0Cv82FLKI

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3976-132-0x0000000000400000-0x0000000000467000-memory.dmp	upx
behavioral2/memory/3976-133-0x0000000000400000-0x0000000000467000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe

Drops file in System32 directory 33 IoCs

Processes:

8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe

description	ioc	process
File created	C:\Windows\SysWOW64\winxcfg.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\Website Hacker.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\Windows 2000.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\tenderonie who insist her pussy must always be free.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\sister and brother gettin' freaky .mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\an asian bush getting a cum bath.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\fistfucking and how ide it goes.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\tight anal fucking like you want it.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\genuine indian slut posing.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\Norton antivirus 2002.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\Jenna Jameson Nude Gang Bang Forced Cum Blowjob.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\movie of mom who whip hot ass on daughter's big cock lover.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\honie with a ka-boom hot ass and delicious cunt.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\babe locking lips around her man's rod in backyard.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\hot butt sex ..unbeliveable.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\aol password cracker.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\kitty-cat with horny beaver that needs licking.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\neighbor boy fucking grandma after mowing her grass.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\brunette fucking in bedroom with boyfriend.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\head rooster pimping hot little tender ass chickens.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\hot anal sex for the first time ever.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\kinky banana in pussy.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\Preteen Rape Sex Illegal - Jenny - 13 Years old.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\horny asian warming her finger in her gash.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\play station emulator crack.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\hot tomoli lathering up sexy body for boyfriend's tongue.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\babes with oversized hooters spreading.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\two teen lesbians with dildo having fun.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\nice facial cumshot for slut.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\chunky broad with a hairy well used ass.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
File created	C:\Windows\SysWOW64\macromd\black girl gets dildo wet.mpg.pif	8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe

C:\Users\Admin\AppData\Local\Temp\8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe
"C:\Users\Admin\AppData\Local\Temp\8817ffb8f11d20ffecf206895792adac9f42ce7bdc0d8a3822bae48169a0ebea.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3976-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3976-133-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads