Analysis
-
max time kernel
169s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 04:15
Behavioral task
behavioral1
Sample
49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe
-
Size
81KB
-
MD5
bb3c09b01c84c825fd011832fdd568f4
-
SHA1
2cb33e59c5529931243f427e32d9ab082affeef7
-
SHA256
49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c
-
SHA512
a882630100354698dbfeb5f4e0661d23237a4557ffdb50761cfddda7be742d21dcdd33cb1eebe4b831c7945973940622af4014a9a0386504c284e995e77eea85
-
SSDEEP
1536:5lrsicagdzn8K2ariPOcjk+XQuPVN72NMS9fMV9UQgCpnaInD5xdDIAzK:5JjcF8KfCOcjk+guPVjS9EV9UZCUmDt4
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3076-132-0x0000000000400000-0x0000000000467000-memory.dmp upx behavioral2/memory/3076-133-0x0000000000400000-0x0000000000467000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe -
Drops file in System32 directory 33 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\sluts who are in control of their slaves.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\strange asian ass odyssey.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\gay blades in the army.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\babe with dick stuck between her ass cheeks.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\young slut being pound in all her tight holes.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\blowjob girl getting a sloppy facial.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\Universal Game Crack.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\hardcored blonde mature.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\cum hungry slut accepting goop.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\brunette fucking in bedroom with boyfriend.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\nude.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\virtua girl - bailey short skirt.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\bad gal being tied and bound.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\tiny girl opening hole in crazy wish of cock.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\teen tied up and raped.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\two interracial lesbians licking each other.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\lesbians lickin and toying.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\sexy ass black slut sucking huge cock.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\old man fucking young blonde teen.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\porn account cracker.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\hot hungry sluts sucking cum for a line of coke.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\hot actress heather graham naked.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\aimhacker.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\crazy old man playing young teen.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\hot butt sex ..unbeliveable.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\amateur spreading more fine ass than stud can handle.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\plump brunette using her finger.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\winxcfg.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\14 year old on beach.mpg.exe 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe File created C:\Windows\SysWOW64\macromd\two kinky old lezbos snapping the whip.mpg.pif 49a2da674ac9913ab4640453093fd1323de4cd63559fe82db32f744d3fc6756c.exe