28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38

General

Target

28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
Size

67KB
MD5

1551ffc21f7260cc28d860a1501882e7
SHA1

5237c96aef11615d351421ca0ac2824cb362200e
SHA256

28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38
SHA512

53a289f7c79623caee99a3279dc2e58a7696844cd86577f8d6ccf1a39e9eb425917836a60c6453e641feceed45df380a537a42ba9d80802cc6bea7104c519303
SSDEEP

768:tks+cAXJpB2TgpZnjJHk/OxJ+oFEZEM/4X:tjrAX5NjJHJ+oFE2M/4X

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VMIntel386 = "C:\\Windows\\Intelx386\\VMIntel386.exe 256mb 32bit"	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe

Drops file in Windows directory 64 IoCs

Processes:

28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe

description	ioc	process
File created	C:\Windows\Intelx386\Pack 50 Juegos PS2.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Terminator 3 Wallpapers.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\WinRar v6.11 (with crack).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Mazinkaiser pack fondos de escritorio.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Pack Photoshop CS 8 plugins.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\WAV2MP3.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Hentai.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\WinAmp skings and plugins.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\3D Studio R8 (It's Work!!).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Puta come mierda.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Visual Basic 6.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Simpsons pack guiones (Temporada 2004).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Pedofilia pack 37 pics.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Matrix Wallpapers.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Winamp 3.5 (full version).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\MSN messenger 6.3.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Solo para Maricas.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\humor.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Shinchan screen saver.scr	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\DivX 7.2 freeware.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\RealOne Player (Full version).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Juegos JAVA para NOKIA.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Visual C.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\a pelo.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Chenoa en cueros.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Update Photoshop 7.0 to Photoshop 9.16 (It´s Work!).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Pack 25 Juegos GameCube.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Resident Evil for GameCube.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\German extreme violation.mpg.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Nero 7.5.1.0 (cracked!).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Hentai Shizuka clit.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Winamp 5.0 (full version).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\BsPlayer v3.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\WinZip 9.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\GBAEmu.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\mugen (full).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Hentai Evangelion Poker.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\VMIntel386.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\WinAce 3.85 (with Serial).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Hacha Profesional Edition.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Update Photoshop 8.0 to Photoshop 9.5 (It´s Work!).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Silent Hill.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Dont Touch.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\WinRar 4 (with crack).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\RM2GBA.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\GameCube Emulator.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Visual Studio (full).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\FlashGet Max acceleration (Experimental).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\3D Movie Maker.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Mazinkaiser comics pack.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Pack Tonos y Logos para Nokia.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\PSEmu.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Follada brutal coño roto.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Lolita Pack 20 Pics.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\No lo Descargues.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Winamp 3 (full version).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Capitulos ineditos de DragonBall Z jamas emitidos.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Pack sex very hot nude young girl porn erotic private pussy rape clitoris suck chicas fotos culos tetas coños mamadas corridas sister hermana amigas friends lesbianas mujeres desnudas putas guarras hentai.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\ContaWin 2000 (full version).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Fuck my fat ass.avi.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\VirtualDub 2.1.4.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Sexo con una menor.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Dont Download.exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
File created	C:\Windows\Intelx386\Download Accelerator Plus (DAP) (full version with serial).exe	28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe

C:\Users\Admin\AppData\Local\Temp\28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe
"C:\Users\Admin\AppData\Local\Temp\28104ad6ed4a92c1ab7d55823d7dc54a25b80027d5f0fba882a6b7dbc634ae38.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:1816

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads